Edit tour

Windows Analysis Report
l4.exe

Overview

General Information

Sample name:	l4.exe
Analysis ID:	1610196
MD5:	fdd35023de9f8049afc50e19742c3cb6
SHA1:	2c5f8c05d79bcccf57f0a7c1180c06fc8d0a0ac3
SHA256:	d7c96cabb5c6e07f7d037cc838a36f53ccfd20fca346d5d4bbac6f25884718f3
Tags:	exeuser-aachum
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found pyInstaller with non standard icon

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SGDT)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

l4.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\l4.exe" MD5: FDD35023DE9F8049AFC50E19742C3CB6)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

l4.exe (PID: 7440 cmdline: "C:\Users\user\Desktop\l4.exe" MD5: FDD35023DE9F8049AFC50E19742C3CB6)

cleanup

Code function: 0_2_00007FF7C2854C50 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF7C2854C50

Source: C:\Users\user\Desktop\l4.exe

Code function: 2_2_00007FFDFAB68816 sgdt fword ptr [rax]

2_2_00007FFDFAB68816

Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\zstandard\_cffi.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\zstandard\backend_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_brotli.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\l4.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-18422

Source: C:\Users\user\Desktop\l4.exe

API coverage: 1.5 %

Source: C:\Users\user\Desktop\l4.exe	Code function: 0_2_00007FF7C28587E0 FindFirstFileExW,FindClose,	0_2_00007FF7C28587E0
Source: C:\Users\user\Desktop\l4.exe	Code function: 0_2_00007FF7C2857810 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7C2857810
Source: C:\Users\user\Desktop\l4.exe	Code function: 0_2_00007FF7C2872A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7C2872A84
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FF7C28587E0 FindFirstFileExW,FindClose,	2_2_00007FF7C28587E0
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FF7C2872A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7C2872A84
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FF7C2857810 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7C2857810
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFB81EFEC FindFirstFileExW,FindClose,FindNextFileW,	2_2_00007FFDFB81EFEC
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFB7F2DFC FindFirstFileExW,	2_2_00007FFDFB7F2DFC

Source: l4.exe, 00000000.00000003.1669297431.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: l4.exe, 00000002.00000003.1722775302.000002714AD6D000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1721930678.000002714AD51000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1733849411.000002714AD75000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1728861695.000002714AD73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: C:\Users\user\Desktop\l4.exe

Code function: 0_2_00007FF7C286B4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: l4.exe	Virustotal: Detection: 30%			Perma Link
Source: l4.exe	ReversingLabs: Detection: 29%

Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: C:\Users\user\Desktop\l4.exe	Code function: String function: 00007FFDFAB9D425 appears 48 times
Source: C:\Users\user\Desktop\l4.exe	Code function: String function: 00007FFDFB7B6448 appears 32 times
Source: C:\Users\user\Desktop\l4.exe	Code function: String function: 00007FF7C2852020 appears 34 times
Source: C:\Users\user\Desktop\l4.exe	Code function: String function: 00007FFDFAB21325 appears 471 times
Source: C:\Users\user\Desktop\l4.exe	Code function: String function: 00007FF7C2851E50 appears 106 times
Source: C:\Users\user\Desktop\l4.exe	Code function: String function: 00007FFDFAB9DB03 appears 45 times
Source: C:\Users\user\Desktop\l4.exe	Code function: String function: 00007FFDFAB9D32F appears 327 times
Source: C:\Users\user\Desktop\l4.exe	Code function: String function: 00007FFDFAB9D33B appears 43 times
Source: C:\Users\user\Desktop\l4.exe	Code function: String function: 00007FFDFAB9D341 appears 1193 times

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: l4.exe, 00000000.00000003.1667490682.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1666424498.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1667727010.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1666507684.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665634754.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665231198.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664414890.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665005466.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1667185506.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1667012024.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664340433.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665786403.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1667609890.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1667366788.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665080815.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1667270569.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1662378215.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs l4.exe
Source: l4.exe, 00000000.00000003.1675616269.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs l4.exe
Source: l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs l4.exe
Source: l4.exe, 00000000.00000003.1678922077.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664857372.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665158353.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665710373.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665477020.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665557217.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1665934166.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1666809497.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1666313733.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1664265546.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664778255.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1666900470.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664933294.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664703216.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665858579.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664490045.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1667094228.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1666678581.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1662172375.000001A65B8AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs l4.exe
Source: l4.exe, 00000000.00000003.1663593875.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1666585929.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1664617672.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1662773946.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1663889108.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1664192735.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665389142.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe, 00000000.00000003.1665308021.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs l4.exe
Source: l4.exe	Binary or memory string: OriginalFilename vs l4.exe
Source: l4.exe, 00000002.00000002.1737929140.0000027149340000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs l4.exe
Source: l4.exe, 00000002.00000002.1749280138.00007FFDFABE0000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamelibsslH vs l4.exe
Source: l4.exe, 00000002.00000002.1751025704.00007FFDFB791000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs l4.exe
Source: l4.exe, 00000002.00000002.1752641087.00007FFE12E16000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.1752176622.00007FFE11523000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.1748968567.00007FFDFAA44000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.1751896734.00007FFE10265000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.1752987705.00007FFE13343000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.1752442209.00007FFE11EE9000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.1753235966.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs l4.exe
Source: l4.exe, 00000002.00000002.1751205534.00007FFDFB89C000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs l4.exe
Source: l4.exe, 00000002.00000002.1750009225.00007FFDFB0E4000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs l4.exe
Source: l4.exe, 00000002.00000002.1752285182.00007FFE11EAE000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.1753102394.00007FFE148E6000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.1752754724.00007FFE130C9000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs l4.exe
Source: l4.exe, 00000002.00000002.1752871564.00007FFE13308000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs l4.exe

Source: unknown	Process created: C:\Users\user\Desktop\l4.exe "C:\Users\user\Desktop\l4.exe"
Source: C:\Users\user\Desktop\l4.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\l4.exe	Process created: C:\Users\user\Desktop\l4.exe "C:\Users\user\Desktop\l4.exe"
Source: C:\Users\user\Desktop\l4.exe	Process created: C:\Users\user\Desktop\l4.exe "C:\Users\user\Desktop\l4.exe"	Jump to behavior

Source: C:\Users\user\Desktop\l4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: l4.exe, 00000002.00000002.1747746639.000002714BC58000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: l4.exe, 00000002.00000002.1749054059.00007FFDFAAA6000.00000002.00000001.01000000.0000000D.sdmp, _brotli.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://.css
Source: l4.exe, 00000002.00000002.1749054059.00007FFDFAAA6000.00000002.00000001.01000000.0000000D.sdmp, _brotli.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://.jpg
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675616269.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663593875.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677111697.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675616269.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663593875.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1662773946.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677135135.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677111697.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663593875.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1662773946.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663889108.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677111697.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675616269.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677135135.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: l4.exe, 00000002.00000003.1720684406.000002714B2BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720070639.000002714B221000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722801710.000002714B32F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720786535.000002714B2EB000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722214200.000002714B2EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: l4.exe, 00000002.00000003.1733105029.000002714B99A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722996334.000002714B740000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724858254.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724072681.000002714B751000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725687556.000002714B957000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B99A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725384469.000002714B948000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.1747329841.000002714B97A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1732708978.000002714B97A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725242111.000002714B947000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1726259282.000002714B97A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720533373.000002714B73A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725950348.000002714B979000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722489125.000002714B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: l4.exe, 00000002.00000003.1733674202.000002714B1EC000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722467432.000002714B1DA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722741757.000002714B1E9000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1721758644.000002714B1C6000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725210564.000002714B1EB000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720684406.000002714B2BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1726523386.000002714B33A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723845811.000002714B330000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.1744991581.000002714B1EC000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720070639.000002714B221000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722801710.000002714B32F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720786535.000002714B2EB000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722214200.000002714B2EC000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722894366.000002714B330000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724681727.000002714B331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: l4.exe, 00000002.00000002.1740158479.0000027149476000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B910000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1728233551.0000027149472000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1721865040.000002714946F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1731088017.0000027149473000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724858254.000002714B938000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1721693912.0000027149464000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: l4.exe, 00000002.00000003.1722996334.000002714B740000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724072681.000002714B751000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720533373.000002714B73A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722489125.000002714B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: l4.exe, 00000002.00000003.1719898604.000002714B910000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724858254.000002714B938000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlB
Source: l4.exe, 00000002.00000002.1740158479.0000027149476000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1728233551.0000027149472000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1721865040.000002714946F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1731088017.0000027149473000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1721693912.0000027149464000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlKq
Source: l4.exe, 00000002.00000003.1724858254.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725687556.000002714B957000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725384469.000002714B948000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.1747329841.000002714B97A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1732708978.000002714B97A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725242111.000002714B947000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1726259282.000002714B97A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725950348.000002714B979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: l4.exe, 00000002.00000003.1724858254.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725687556.000002714B957000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725384469.000002714B948000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.1747329841.000002714B97A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1732708978.000002714B97A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725242111.000002714B947000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1726259282.000002714B97A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725950348.000002714B979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl(
Source: l4.exe, 00000002.00000003.1733105029.000002714B99A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B99A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: l4.exe, 00000002.00000003.1722996334.000002714B740000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724072681.000002714B751000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720533373.000002714B73A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722489125.000002714B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl_
Source: l4.exe, 00000002.00000003.1725670603.000002714B91B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B910000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: l4.exe, 00000002.00000003.1722489125.000002714B7A9000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723415697.000002714B7C5000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1726765587.000002714B7E8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723898598.000002714B7E6000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725712727.000002714B7E7000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722996334.000002714B7A9000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720533373.000002714B7A9000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724580221.000002714B7E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: l4.exe, 00000002.00000003.1725670603.000002714B91B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B910000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: l4.exe, 00000002.00000003.1722489125.000002714B7A9000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723415697.000002714B7C5000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1726765587.000002714B7E8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723898598.000002714B7E6000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725712727.000002714B7E7000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722996334.000002714B7A9000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720533373.000002714B7A9000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724580221.000002714B7E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: l4.exe, 00000002.00000003.1725670603.000002714B91B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B910000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: l4.exe, 00000002.00000003.1720684406.000002714B2BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1726523386.000002714B33A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723845811.000002714B330000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720070639.000002714B221000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722801710.000002714B32F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720786535.000002714B2EB000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722214200.000002714B2EC000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722894366.000002714B330000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724681727.000002714B331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677111697.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675616269.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677135135.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677111697.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675616269.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663593875.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1662773946.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677111697.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663593875.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1662773946.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663889108.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeS
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677111697.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675616269.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663593875.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1662773946.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: l4.exe, 00000002.00000002.1747746639.000002714BC04000.00000004.00001000.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1727424361.000002714B760000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722996334.000002714B740000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724072681.000002714B751000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1726783359.000002714B75D000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1736661708.000002714B760000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720533373.000002714B73A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722489125.000002714B73A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.1746417560.000002714B762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: l4.exe, 00000002.00000003.1722894366.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.1745702138.000002714B2F4000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725327239.000002714B2EE000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722801710.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720786535.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1726887219.000002714B2EF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720684406.000002714B2BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725082539.000002714B374000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1727749915.000002714B379000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1728671213.000002714B2EF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1734010974.000002714B2F4000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720070639.000002714B221000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720786535.000002714B2EB000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722214200.000002714B2EC000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723770552.000002714B373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: l4.exe, 00000002.00000003.1722894366.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725175449.000002714B37C000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722801710.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720786535.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725082539.000002714B374000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723770552.000002714B373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: l4.exe, 00000002.00000003.1722894366.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.1745479111.000002714B2D3000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1722801710.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720786535.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720684406.000002714B2BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1691281716.000002714B2CC000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725082539.000002714B374000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1724228913.000002714B2BB000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725100760.000002714B2C9000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1691094855.000002714B360000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1727668730.000002714B2CC000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720070639.000002714B221000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723607324.000002714B2BB000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1723770552.000002714B373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: l4.exe, 00000002.00000002.1749054059.00007FFDFAAA6000.00000002.00000001.01000000.0000000D.sdmp, _brotli.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: l4.exe, 00000002.00000003.1724858254.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725687556.000002714B957000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725384469.000002714B948000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725242111.000002714B947000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B93B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: l4.exe, 00000002.00000003.1724858254.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725687556.000002714B957000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725384469.000002714B948000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725242111.000002714B947000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B93B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: l4.exe, 00000002.00000003.1724858254.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725687556.000002714B957000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725384469.000002714B948000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1720919198.000002714B93B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1725242111.000002714B947000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000003.1719898604.000002714B93B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.esf5
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677111697.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675616269.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663593875.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1662773946.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677135135.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: l4.exe, 00000000.00000003.1676041090.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677111697.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663813261.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673977206.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1676041090.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663702832.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678665035.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664119386.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680601791.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675616269.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675675652.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1675951876.000001A65B8B8000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1664001701.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1663434984.000001A65B8B0000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8B2000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1680761556.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1673920400.000001A65B8BA000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1677135135.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1678719453.000001A65B8BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFAB44331 push rcx; ret	2_2_00007FFDFAB44332
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFB7D4A15 push rdi; ret	2_2_00007FFDFB7D4A1B
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFB7D9F52 push rdi; ret	2_2_00007FFDFB7D9F56
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFB7D983D push rdi; ret	2_2_00007FFDFB7D9844
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFB7D44F9 push rdi; ret	2_2_00007FFDFB7D4502

Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\zstandard\_cffi.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\zstandard\backend_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_brotli.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\l4.exe	Code function: 0_2_00007FF7C286B4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7C286B4F8
Source: C:\Users\user\Desktop\l4.exe	Code function: 0_2_00007FF7C285C840 SetUnhandledExceptionFilter,	0_2_00007FF7C285C840
Source: C:\Users\user\Desktop\l4.exe	Code function: 0_2_00007FF7C285BE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7C285BE00
Source: C:\Users\user\Desktop\l4.exe	Code function: 0_2_00007FF7C285C69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7C285C69C
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FF7C286B4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7C286B4F8
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FF7C285C840 SetUnhandledExceptionFilter,	2_2_00007FF7C285C840
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FF7C285BE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF7C285BE00
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FF7C285C69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7C285C69C
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFA932A70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDFA932A70
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFA933028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDFA933028
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFAAA40A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDFAAA40A0
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFAB2212B IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDFAB2212B
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFB81CC28 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDFB81CC28
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFDFB7F22DC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDFB7F22DC
Source: C:\Users\user\Desktop\l4.exe	Code function: 2_2_00007FFE0133DC70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFE0133DC70

Source: C:\Users\user\Desktop\l4.exe	Code function: GetProcAddress,GetLocaleInfoW,	2_2_00007FFDFB7B3AE0
Source: C:\Users\user\Desktop\l4.exe	Code function: EnumSystemLocalesW,	2_2_00007FFDFB81AF64
Source: C:\Users\user\Desktop\l4.exe	Code function: EnterCriticalSection,EnumSystemLocalesW,LeaveCriticalSection,	2_2_00007FFDFB818FB8
Source: C:\Users\user\Desktop\l4.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	2_2_00007FFDFB81AFC4
Source: C:\Users\user\Desktop\l4.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	2_2_00007FFDFB81B074
Source: C:\Users\user\Desktop\l4.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00007FFDFB81B62C
Source: C:\Users\user\Desktop\l4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00007FFDFB81B4B8

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	32 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
l4.exe	31%	Virustotal		Browse
l4.exe	29%	ReversingLabs	Win64.Trojan.DDOSAgent

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_brotli.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\bcrypt\_bcrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\zstandard\_cffi.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\zstandard\backend_c.cp312-win_amd64.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://repository.swisssign.com/e	0%	Avira URL Cloud	safe
http://ocsp.accv.esf5	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
raw.githubusercontent.com	185.199.108.133	true	false		high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report l4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140_1.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\_brotli.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\_cffi_backend.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\_wmi.pyd

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-handle-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-heap-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73442\api-ms-win-core-interlocked-l1-1-0.dll

Windows Analysis Report
l4.exe

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1610196
Start date and time:	2025-02-08 18:40:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	l4.exe
Detection:	MAL
Classification:	mal52.winEXE@4/79@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.199.108.133	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gaber.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	filw.exe	Get hash	malicious	Stealerium	Browse	185.199.108.133
	main.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	europe.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	185.199.108.133
	kjjA3Ebw2c.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	kjjA3Ebw2c.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	bypass.bat	Get hash	malicious	Braodo, XWorm	Browse	185.199.108.133
	X8do5kx7N9.exe	Get hash	malicious	Discord Token Stealer, XWorm	Browse	185.199.108.133
	Payment slip.vbs	Get hash	malicious	Discord Token Stealer	Browse	185.199.110.133
	http://dro.pm/ax	Get hash	malicious	Quasar	Browse	185.199.109.133
	http://nanobotrock.com	Get hash	malicious	Anonymous Proxy	Browse	185.199.109.133
bg.microsoft.map.fastly.net	DocJets.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	image_processor (2).exe.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	RFQ_MIPCO .xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	RFQ_MIPCO .xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	RFQ_MIPCO .xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	c.exe	Get hash	malicious	MeshAgent	Browse	199.232.214.172
	Ld3pkWLjgX.exe	Get hash	malicious	AsyncRAT, GuLoader	Browse	199.232.214.172
	0irFoaxbQx.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	https://t.co/4HhUrxCmX4	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	f_0139ee	Get hash	malicious	Unknown	Browse	199.232.210.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	filw.exe	Get hash	malicious	Stealerium	Browse	185.199.108.133
	main.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	europe.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	185.199.108.133
	https://docs.google.com/drawings/d/1jMxa3xnHDyQJ5_Ou8skqyuRslhdmGmULR5h7goJFaB0/preview	Get hash	malicious	GRQ Scam	Browse	151.101.194.208
	https://github.com/Berusol/Xeno-Executor/releases/download/Setup/Xeno.Roblox.rar	Get hash	malicious	LummaC Stealer, PureLog Stealer, Xmrig, zgRAT	Browse	185.199.109.133
	https://hdtodaytv.pics	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	https://docs-trzor-cdn-suite.weebly.com/	Get hash	malicious	Unknown	Browse	151.101.129.46
	https://trezzor-suiteapp.github.io/	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
	http://f9ffbe30-9ed1-4ee5-989b-efe75841acd7-00-3p9n3xujzx1f7.riker.replit.dev/english.html	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://bafkreienx3cy3vi7dnypx3ewxbzblahkg3i7jujv2tr6re6yhvqftdki7i.ipfs.flk-ipfs.xyz/	Get hash	malicious	Unknown	Browse	151.101.66.137

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140.dll	LLpXuQ2XPb.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	tP5086S.exe	Get hash	malicious	Unknown	Browse
	G8lVmiI.exe	Get hash	malicious	Unknown	Browse
	bypass.bat	Get hash	malicious	Braodo, XWorm	Browse
	path.exe	Get hash	malicious	Python Stealer, Braodo	Browse
	bot1.exe	Get hash	malicious	Unknown	Browse
	FileArchive_v2.0.exe	Get hash	malicious	Unknown	Browse
	Timeless-MBN8nDw-G.exe	Get hash	malicious	Unknown	Browse
	Timeless-MBN8nDw-G.exe	Get hash	malicious	Unknown	Browse
	Trio_Agent.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140_1.dll	tP5086S.exe	Get hash	malicious	Unknown	Browse
	G8lVmiI.exe	Get hash	malicious	Unknown	Browse
	bypass.bat	Get hash	malicious	Braodo, XWorm	Browse
	path.exe	Get hash	malicious	Python Stealer, Braodo	Browse
	bot1.exe	Get hash	malicious	Unknown	Browse
	Timeless-MBN8nDw-G.exe	Get hash	malicious	Unknown	Browse
	Timeless-MBN8nDw-G.exe	Get hash	malicious	Unknown	Browse
	Trio_Agent.exe	Get hash	malicious	Unknown	Browse
	Trio_Agent.exe	Get hash	malicious	AsyncRAT	Browse
	emailproxy.exe	Get hash	malicious	Unknown	Browse

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: LLpXuQ2XPb.exe, Detection: malicious, Browse Filename: tP5086S.exe, Detection: malicious, Browse Filename: G8lVmiI.exe, Detection: malicious, Browse Filename: bypass.bat, Detection: malicious, Browse Filename: path.exe, Detection: malicious, Browse Filename: bot1.exe, Detection: malicious, Browse Filename: FileArchive_v2.0.exe, Detection: malicious, Browse Filename: Timeless-MBN8nDw-G.exe, Detection: malicious, Browse Filename: Timeless-MBN8nDw-G.exe, Detection: malicious, Browse Filename: Trio_Agent.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.994648461599204
TrID:	Win64 Executable (PyInstaller) (227505/4) 46.56% Win64 Executable Console (202006/5) 41.35% InstallShield setup (43055/19) 8.81% Win64 Executable (generic) (12005/4) 2.46% Generic Win/DOS Executable (2004/3) 0.41%
File name:	l4.exe
File size:	13'758'678 bytes
MD5:	fdd35023de9f8049afc50e19742c3cb6
SHA1:	2c5f8c05d79bcccf57f0a7c1180c06fc8d0a0ac3
SHA256:	d7c96cabb5c6e07f7d037cc838a36f53ccfd20fca346d5d4bbac6f25884718f3
SHA512:	05424f7bafe2da504ba6abf4bf6a079b6817e6b1f7dfd16ebbdba5f7168c88a2c4a1408d8971167cc75256dee870c4257ad05328388c6324fa236bf43e2149dd
SSDEEP:	393216:DC+KQhZ2YsHFUK2J7XMCHWUj5jx5WsqWxTz0Y3nSYzxLj:DCXQZ2YwUlJ7XMb8ksqAzDv
TLSH:	E2D6335022F169E5DDBB843D69E7E599E632F85617B4C28B97CC23930E231D46F38322
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..............f.......f..)....f......Y.......Y.......Y.......Y........f..............................Rich...................

Entrypoint:	0x14000c320
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x677FEA64 [Thu Jan 9 15:25:24 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a06f302f71edd380da3d5bf4a6d94ebd

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ea2c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0xef8c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x22f8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x58000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3bfb0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3be70	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d000	0x400	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b110	0x2b200	55ff5ed922edfe0b0c10734c674f4ee4	False	0.5453521286231884	data	6.496893972670116	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0x12842	0x12a00	f271e38c789ced3774cfb2ef656a9bfa	False	0.5235816904362416	data	5.767543090603831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x40000	0x5408	0xe00	aff56347f897785154c53727472c548d	False	0.13504464285714285	data	1.8315705466577277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x22f8	0x2400	57f77a295f3be6e2a8e90035dde19ce2	False	0.4784071180555556	data	5.3594808562266065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0xef8c	0xf000	5d72e0338b034862f777c781ab7d2219	False	0.8010091145833333	data	7.3501462320035476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x58000	0x768	0x800	42d6242177dbae8e11ed5d64b87d0d48	False	0.5576171875	data	5.268722219019965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ