a6ca5523fce6

C:\Users\RDhJ0CNFevzX\Desktop\a6ca5523fce6a4a43964319c35ecb868186465309e9226ab07c158519a5ef6f9.exe

Sample File

Binary

»

MIME Type	application/vnd.microsoft.portable-executable
File Size	4.50 MB
MD5	280bfd5ea1f41586ea0ef60ee44bc8db
SHA1	57aa866f42bccbaceed938390001148323d033c1
SHA256	a6ca5523fce6a4a43964319c35ecb868186465309e9226ab07c158519a5ef6f9
SSDeep	98304:keFfhFS2DkSocOZKjg/sN0GkhVT8pxlxE7SSvsaTGN:keFfhxISoJZKs/DjV0xESmeN
ImpHash	56a78d55f3f7af51443e58e0ce2fb5f6

File Reputation Information

»

Verdict	malicious
Names	Mal/Generic-S

PE Information

»

Image Base	0x400000
Entry Point	0x40352d
Size Of Code	0x6a00
Size Of Initialized Data	0x2da00
Size Of Uninitialized Data	0x800
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2021-09-25 21:57:46+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x6897	0x6a00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.46
.rdata	0x408000	0x14a6	0x1600	0x6e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.02
.data	0x40a000	0x2b018	0x600	0x8400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	4.15
.ndata	0x436000	0x10000	0x0	0x0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.rsrc	0x446000	0x42a8	0x4400	0x8a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.14

Imports (7)

»

ADVAPI32.dll (13)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegCreateKeyExW	-	0x408000	0x86b0	0x74b0	0x1d2
RegEnumKeyW	-	0x408004	0x86b4	0x74b4	0x1e0
RegQueryValueExW	-	0x408008	0x86b8	0x74b8	0x1f8
RegSetValueExW	-	0x40800c	0x86bc	0x74bc	0x205
RegCloseKey	-	0x408010	0x86c0	0x74c0	0x1cb
RegDeleteValueW	-	0x408014	0x86c4	0x74c4	0x1d9
RegDeleteKeyW	-	0x408018	0x86c8	0x74c8	0x1d7
AdjustTokenPrivileges	-	0x40801c	0x86cc	0x74cc	0x1c
LookupPrivilegeValueW	-	0x408020	0x86d0	0x74d0	0x150
OpenProcessToken	-	0x408024	0x86d4	0x74d4	0x1ac
SetFileSecurityW	-	0x408028	0x86d8	0x74d8	0x22f
RegOpenKeyExW	-	0x40802c	0x86dc	0x74dc	0x1ed
RegEnumValueW	-	0x408030	0x86e0	0x74e0	0x1e2

SHELL32.dll (6)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SHGetSpecialFolderLocation	-	0x408178	0x8828	0x7628	0xc3
SHFileOperationW	-	0x40817c	0x882c	0x762c	0x9b
SHBrowseForFolderW	-	0x408180	0x8830	0x7630	0x7a
SHGetPathFromIDListW	-	0x408184	0x8834	0x7634	0xbd
ShellExecuteExW	-	0x408188	0x8838	0x7638	0x10a
SHGetFileInfoW	-	0x40818c	0x883c	0x763c	0xad

ole32.dll (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OleInitialize	-	0x408298	0x8948	0x7748	0xee
OleUninitialize	-	0x40829c	0x894c	0x774c	0x105
CoCreateInstance	-	0x4082a0	0x8950	0x7750	0x10
IIDFromString	-	0x4082a4	0x8954	0x7754	0xc6
CoTaskMemFree	-	0x4082a8	0x8958	0x7758	0x65

COMCTL32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
(by ordinal)	0x11	0x408038	0x86e8	0x74e8	-
ImageList_Create	-	0x40803c	0x86ec	0x74ec	0x37
ImageList_Destroy	-	0x408040	0x86f0	0x74f0	0x38
ImageList_AddMasked	-	0x408044	0x86f4	0x74f4	0x34

USER32.dll (64)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetClientRect	-	0x408194	0x8844	0x7644	0xff
EndPaint	-	0x408198	0x8848	0x7648	0xc8
DrawTextW	-	0x40819c	0x884c	0x764c	0xbf
IsWindowEnabled	-	0x4081a0	0x8850	0x7650	0x1ae
DispatchMessageW	-	0x4081a4	0x8854	0x7654	0xa2
wsprintfA	-	0x4081a8	0x8858	0x7658	0x2d7
CharNextA	-	0x4081ac	0x885c	0x765c	0x2a
CharPrevW	-	0x4081b0	0x8860	0x7660	0x2f
MessageBoxIndirectW	-	0x4081b4	0x8864	0x7664	0x1e3
GetDlgItemTextW	-	0x4081b8	0x8868	0x7668	0x114
SetDlgItemTextW	-	0x4081bc	0x886c	0x766c	0x254
GetSystemMetrics	-	0x4081c0	0x8870	0x7670	0x15d
FillRect	-	0x4081c4	0x8874	0x7674	0xe2
AppendMenuW	-	0x4081c8	0x8878	0x7678	0x9
TrackPopupMenu	-	0x4081cc	0x887c	0x767c	0x2a4
OpenClipboard	-	0x4081d0	0x8880	0x7680	0x1f6
SetClipboardData	-	0x4081d4	0x8884	0x7684	0x24a
CloseClipboard	-	0x4081d8	0x8888	0x7688	0x42
IsWindowVisible	-	0x4081dc	0x888c	0x768c	0x1b1
CallWindowProcW	-	0x4081e0	0x8890	0x7690	0x1c
GetMessagePos	-	0x4081e4	0x8894	0x7694	0x13c
CheckDlgButton	-	0x4081e8	0x8898	0x7698	0x38
LoadCursorW	-	0x4081ec	0x889c	0x769c	0x1bd
SetCursor	-	0x4081f0	0x88a0	0x76a0	0x24d
GetSysColor	-	0x4081f4	0x88a4	0x76a4	0x15a
SetWindowPos	-	0x4081f8	0x88a8	0x76a8	0x283
GetWindowLongW	-	0x4081fc	0x88ac	0x76ac	0x16f
PeekMessageW	-	0x408200	0x88b0	0x76b0	0x201
SetClassLongW	-	0x408204	0x88b4	0x76b4	0x248
GetSystemMenu	-	0x408208	0x88b8	0x76b8	0x15c
EnableMenuItem	-	0x40820c	0x88bc	0x76bc	0xc2
GetWindowRect	-	0x408210	0x88c0	0x76c0	0x174
ScreenToClient	-	0x408214	0x88c4	0x76c4	0x231
EndDialog	-	0x408218	0x88c8	0x76c8	0xc6
RegisterClassW	-	0x40821c	0x88cc	0x76cc	0x219
SystemParametersInfoW	-	0x408220	0x88d0	0x76d0	0x29a
CreateWindowExW	-	0x408224	0x88d4	0x76d4	0x61
GetClassInfoW	-	0x408228	0x88d8	0x76d8	0xf9
DialogBoxParamW	-	0x40822c	0x88dc	0x76dc	0x9f
CharNextW	-	0x408230	0x88e0	0x76e0	0x2c
ExitWindowsEx	-	0x408234	0x88e4	0x76e4	0xe1
DestroyWindow	-	0x408238	0x88e8	0x76e8	0x99
CreateDialogParamW	-	0x40823c	0x88ec	0x76ec	0x56
SetTimer	-	0x408240	0x88f0	0x76f0	0x27a
SetWindowTextW	-	0x408244	0x88f4	0x76f4	0x287
PostQuitMessage	-	0x408248	0x88f8	0x76f8	0x204
SetForegroundWindow	-	0x40824c	0x88fc	0x76fc	0x257
ShowWindow	-	0x408250	0x8900	0x7700	0x292
wsprintfW	-	0x408254	0x8904	0x7704	0x2d8
SendMessageTimeoutW	-	0x408258	0x8908	0x7708	0x23f
FindWindowExW	-	0x40825c	0x890c	0x770c	0xe5
IsWindow	-	0x408260	0x8910	0x7710	0x1ad
GetDlgItem	-	0x408264	0x8914	0x7714	0x111
SetWindowLongW	-	0x408268	0x8918	0x7718	0x281
LoadImageW	-	0x40826c	0x891c	0x771c	0x1c1
GetDC	-	0x408270	0x8920	0x7720	0x10c
ReleaseDC	-	0x408274	0x8924	0x7724	0x22a
EnableWindow	-	0x408278	0x8928	0x7728	0xc4
InvalidateRect	-	0x40827c	0x892c	0x772c	0x193
SendMessageW	-	0x408280	0x8930	0x7730	0x240
DefWindowProcW	-	0x408284	0x8934	0x7734	0x8f
BeginPaint	-	0x408288	0x8938	0x7738	0xd
EmptyClipboard	-	0x40828c	0x893c	0x773c	0xc1
CreatePopupMenu	-	0x408290	0x8940	0x7740	0x5e

GDI32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetBkMode	-	0x40804c	0x86fc	0x74fc	0x216
SetBkColor	-	0x408050	0x8700	0x7500	0x215
GetDeviceCaps	-	0x408054	0x8704	0x7504	0x16b
CreateFontIndirectW	-	0x408058	0x8708	0x7508	0x3d
CreateBrushIndirect	-	0x40805c	0x870c	0x750c	0x29
DeleteObject	-	0x408060	0x8710	0x7510	0x8f
SetTextColor	-	0x408064	0x8714	0x7514	0x23c
SelectObject	-	0x408068	0x8718	0x7518	0x20e

KERNEL32.dll (65)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetExitCodeProcess	-	0x408070	0x8720	0x7520	0x15a
WaitForSingleObject	-	0x408074	0x8724	0x7524	0x390
GetModuleHandleA	-	0x408078	0x8728	0x7528	0x17f
GetProcAddress	-	0x40807c	0x872c	0x752c	0x1a0
GetSystemDirectoryW	-	0x408080	0x8730	0x7530	0x1c2
lstrcatW	-	0x408084	0x8734	0x7534	0x3be
Sleep	-	0x408088	0x8738	0x7538	0x356
lstrcpyA	-	0x40808c	0x873c	0x753c	0x3c6
WriteFile	-	0x408090	0x8740	0x7540	0x3a4
GetTempFileNameW	-	0x408094	0x8744	0x7544	0x1d4
CreateFileW	-	0x408098	0x8748	0x7548	0x56
lstrcmpiA	-	0x40809c	0x874c	0x754c	0x3c3
RemoveDirectoryW	-	0x4080a0	0x8750	0x7550	0x2c5
CreateProcessW	-	0x4080a4	0x8754	0x7554	0x69
CreateDirectoryW	-	0x4080a8	0x8758	0x7558	0x4e
GetLastError	-	0x4080ac	0x875c	0x755c	0x171
CreateThread	-	0x4080b0	0x8760	0x7560	0x6f
GlobalLock	-	0x4080b4	0x8764	0x7564	0x203
GlobalUnlock	-	0x4080b8	0x8768	0x7568	0x20a
GetDiskFreeSpaceW	-	0x4080bc	0x876c	0x756c	0x150
WideCharToMultiByte	-	0x4080c0	0x8770	0x7570	0x394
lstrcpynW	-	0x4080c4	0x8774	0x7574	0x3ca
lstrlenW	-	0x4080c8	0x8778	0x7578	0x3cd
SetErrorMode	-	0x4080cc	0x877c	0x757c	0x315
GetVersionExW	-	0x4080d0	0x8780	0x7580	0x1ea
GetCommandLineW	-	0x4080d4	0x8784	0x7584	0x111
GetTempPathW	-	0x4080d8	0x8788	0x7588	0x1d6
GetWindowsDirectoryW	-	0x4080dc	0x878c	0x758c	0x1f4
SetEnvironmentVariableW	-	0x4080e0	0x8790	0x7590	0x314
CopyFileW	-	0x4080e4	0x8794	0x7594	0x46
ExitProcess	-	0x4080e8	0x8798	0x7598	0xb9
GetCurrentProcess	-	0x4080ec	0x879c	0x759c	0x142
GetModuleFileNameW	-	0x4080f0	0x87a0	0x75a0	0x17e
GetFileSize	-	0x4080f4	0x87a4	0x75a4	0x163
GetTickCount	-	0x4080f8	0x87a8	0x75a8	0x1df
MulDiv	-	0x4080fc	0x87ac	0x75ac	0x274
SetFileAttributesW	-	0x408100	0x87b0	0x75b0	0x31a
GetFileAttributesW	-	0x408104	0x87b4	0x75b4	0x161
SetCurrentDirectoryW	-	0x408108	0x87b8	0x75b8	0x30b
MoveFileW	-	0x40810c	0x87bc	0x75bc	0x271
GetFullPathNameW	-	0x408110	0x87c0	0x75c0	0x16a
GetShortPathNameW	-	0x408114	0x87c4	0x75c4	0x1b6
SearchPathW	-	0x408118	0x87c8	0x75c8	0x2dc
CompareFileTime	-	0x40811c	0x87cc	0x75cc	0x39
SetFileTime	-	0x408120	0x87d0	0x75d0	0x31f
CloseHandle	-	0x408124	0x87d4	0x75d4	0x34
lstrcmpiW	-	0x408128	0x87d8	0x75d8	0x3c4
lstrcmpW	-	0x40812c	0x87dc	0x75dc	0x3c1
ExpandEnvironmentStringsW	-	0x408130	0x87e0	0x75e0	0xbd
GlobalFree	-	0x408134	0x87e4	0x75e4	0x1ff
GlobalAlloc	-	0x408138	0x87e8	0x75e8	0x1f8
GetModuleHandleW	-	0x40813c	0x87ec	0x75ec	0x182
LoadLibraryExW	-	0x408140	0x87f0	0x75f0	0x254
MoveFileExW	-	0x408144	0x87f4	0x75f4	0x270
FreeLibrary	-	0x408148	0x87f8	0x75f8	0xf8
WritePrivateProfileStringW	-	0x40814c	0x87fc	0x75fc	0x3aa
GetPrivateProfileStringW	-	0x408150	0x8800	0x7600	0x19d
lstrlenA	-	0x408154	0x8804	0x7604	0x3cc
MultiByteToWideChar	-	0x408158	0x8808	0x7608	0x275
ReadFile	-	0x40815c	0x880c	0x760c	0x2b5
SetFilePointer	-	0x408160	0x8810	0x7610	0x31b
FindClose	-	0x408164	0x8814	0x7614	0xce
FindNextFileW	-	0x408168	0x8818	0x7618	0xdd
FindFirstFileW	-	0x40816c	0x881c	0x761c	0xd5
DeleteFileW	-	0x408170	0x8820	0x7620	0x84

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	YARA	Actions
a6ca5523fce6a4a43964319c35ecb868186465309e9226ab07c158519a5ef6f9.exe	1	0x00400000	0x0044AFFF	Relevant Image		32-bit	0x0040690A		... Memory Dump Actions Go to Process Download Dump
a6ca5523fce6a4a43964319c35ecb868186465309e9226ab07c158519a5ef6f9.exe	1	0x00400000	0x0044AFFF	Process Termination		32-bit	-		... Memory Dump Actions Go to Process Download Dump

C:\Users\RDhJ0CNFevzX\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe

Dropped File

Binary

»

MIME Type	application/vnd.microsoft.portable-executable
File Size	4.80 MB
MD5	d55dc38b4ee6bed2168e74194533c572
SHA1	431f6f9aeb280102e8764a5184cabe6cc98052ca
SHA256	4b283ec8e073fb61bbb612a152eb332a5c92e7473cf6584a8b716fd87684a936
SSDeep	98304:aqbWYKVEOkkj9NM8zWTl2ALz6dggqBu0teFFJyMEllE+VeJqUH:idzW0QuRabllA7
ImpHash	c33829b568ec9b6c1dfc189fb1d104e4

File Reputation Information

»

Verdict	malicious
Names	Mal/Generic-S

PE Information

»

Image Base	0x400000
Entry Point	0x40953b
Size Of Code	0x42b000
Size Of Initialized Data	0x14000
File Type	FileType.executable
Subsystem	Subsystem.windows_cui
Machine Type	MachineType.i386
Compile Timestamp	2022-03-24 19:13:50+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x23fe5	0x24000	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.58
.nQuHRq	0x425000	0x406fed	0x407000	0x24400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	5.79
.rdata	0x82c000	0xfbbe	0xfc00	0x42b400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.69
.data	0x83c000	0x1ce8	0x1000	0x43b000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	3.05
.9SAT	0x83e000	0x88cb0	0x88e00	0x43c000	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.84

Imports (2)

»

USER32.dll (6)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetSysColorBrush	-	0x82c140	0x43b568	0x43a968	0x1c2
MessageBeep	-	0x82c144	0x43b56c	0x43a96c	0x280
MessageBoxW	-	0x82c148	0x43b570	0x43a970	0x288
MessageBoxA	-	0x82c14c	0x43b574	0x43a974	0x281
GetSystemMetrics	-	0x82c150	0x43b578	0x43a978	0x1c5
SendNotifyMessageA	-	0x82c154	0x43b57c	0x43a97c	0x315

KERNEL32.dll (79)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TlsGetValue	-	0x82c000	0x43b428	0x43a828	0x5a4
CreateFileW	-	0x82c004	0x43b42c	0x43a82c	0xce
HeapSize	-	0x82c008	0x43b430	0x43a830	0x351
GetProcessHeap	-	0x82c00c	0x43b434	0x43a834	0x2b7
SetStdHandle	-	0x82c010	0x43b438	0x43a838	0x54e
SetEnvironmentVariableW	-	0x82c014	0x43b43c	0x43a83c	0x516
FreeEnvironmentStringsW	-	0x82c018	0x43b440	0x43a840	0x1ad
GetLastError	-	0x82c01c	0x43b444	0x43a844	0x264
GetCurrentProcessId	-	0x82c020	0x43b448	0x43a848	0x21b
GetCurrentThreadId	-	0x82c024	0x43b44c	0x43a84c	0x21f
VirtualAlloc	-	0x82c028	0x43b450	0x43a850	0x5ca
GetModuleHandleA	-	0x82c02c	0x43b454	0x43a854	0x278
GetProcAddress	-	0x82c030	0x43b458	0x43a858	0x2b1
MultiByteToWideChar	-	0x82c034	0x43b45c	0x43a85c	0x3f3
FreeConsole	-	0x82c038	0x43b460	0x43a860	0x1ab
GetConsoleWindow	-	0x82c03c	0x43b464	0x43a864	0x20a
WideCharToMultiByte	-	0x82c040	0x43b468	0x43a868	0x602
EnterCriticalSection	-	0x82c044	0x43b46c	0x43a86c	0x134
LeaveCriticalSection	-	0x82c048	0x43b470	0x43a870	0x3c1
InitializeCriticalSectionEx	-	0x82c04c	0x43b474	0x43a874	0x363
DeleteCriticalSection	-	0x82c050	0x43b478	0x43a878	0x113
EncodePointer	-	0x82c054	0x43b47c	0x43a87c	0x130
DecodePointer	-	0x82c058	0x43b480	0x43a880	0x10c
LCMapStringEx	-	0x82c05c	0x43b484	0x43a884	0x3b4
GetStringTypeW	-	0x82c060	0x43b488	0x43a888	0x2da
GetCPInfo	-	0x82c064	0x43b48c	0x43a88c	0x1c4
UnhandledExceptionFilter	-	0x82c068	0x43b490	0x43a890	0x5b1
SetUnhandledExceptionFilter	-	0x82c06c	0x43b494	0x43a894	0x571
GetCurrentProcess	-	0x82c070	0x43b498	0x43a898	0x21a
TerminateProcess	-	0x82c074	0x43b49c	0x43a89c	0x590
IsProcessorFeaturePresent	-	0x82c078	0x43b4a0	0x43a8a0	0x389
QueryPerformanceCounter	-	0x82c07c	0x43b4a4	0x43a8a4	0x44f
GetSystemTimeAsFileTime	-	0x82c080	0x43b4a8	0x43a8a8	0x2ec
InitializeSListHead	-	0x82c084	0x43b4ac	0x43a8ac	0x366
IsDebuggerPresent	-	0x82c088	0x43b4b0	0x43a8b0	0x382
GetStartupInfoW	-	0x82c08c	0x43b4b4	0x43a8b4	0x2d3
GetModuleHandleW	-	0x82c090	0x43b4b8	0x43a8b8	0x27b
GetEnvironmentStringsW	-	0x82c094	0x43b4bc	0x43a8bc	0x23a
RaiseException	-	0x82c098	0x43b4c0	0x43a8c0	0x464
RtlUnwind	-	0x82c09c	0x43b4c4	0x43a8c4	0x4d5
SetLastError	-	0x82c0a0	0x43b4c8	0x43a8c8	0x534
InitializeCriticalSectionAndSpinCount	-	0x82c0a4	0x43b4cc	0x43a8cc	0x362
TlsAlloc	-	0x82c0a8	0x43b4d0	0x43a8d0	0x5a2
WriteConsoleW	-	0x82c0ac	0x43b4d4	0x43a8d4	0x615
TlsSetValue	-	0x82c0b0	0x43b4d8	0x43a8d8	0x5a5
TlsFree	-	0x82c0b4	0x43b4dc	0x43a8dc	0x5a3
FreeLibrary	-	0x82c0b8	0x43b4e0	0x43a8e0	0x1ae
LoadLibraryExW	-	0x82c0bc	0x43b4e4	0x43a8e4	0x3c7
GetStdHandle	-	0x82c0c0	0x43b4e8	0x43a8e8	0x2d5
WriteFile	-	0x82c0c4	0x43b4ec	0x43a8ec	0x616
GetModuleFileNameW	-	0x82c0c8	0x43b4f0	0x43a8f0	0x277
ExitProcess	-	0x82c0cc	0x43b4f4	0x43a8f4	0x161
GetModuleHandleExW	-	0x82c0d0	0x43b4f8	0x43a8f8	0x27a
GetCommandLineA	-	0x82c0d4	0x43b4fc	0x43a8fc	0x1d9
GetCommandLineW	-	0x82c0d8	0x43b500	0x43a900	0x1da
HeapAlloc	-	0x82c0dc	0x43b504	0x43a904	0x348
HeapFree	-	0x82c0e0	0x43b508	0x43a908	0x34c
CompareStringW	-	0x82c0e4	0x43b50c	0x43a90c	0x9e
LCMapStringW	-	0x82c0e8	0x43b510	0x43a910	0x3b5
GetLocaleInfoW	-	0x82c0ec	0x43b514	0x43a914	0x268
IsValidLocale	-	0x82c0f0	0x43b518	0x43a918	0x391
GetUserDefaultLCID	-	0x82c0f4	0x43b51c	0x43a91c	0x315
EnumSystemLocalesW	-	0x82c0f8	0x43b520	0x43a920	0x157
GetFileType	-	0x82c0fc	0x43b524	0x43a924	0x251
CloseHandle	-	0x82c100	0x43b528	0x43a928	0x89
FlushFileBuffers	-	0x82c104	0x43b52c	0x43a92c	0x1a2
GetConsoleOutputCP	-	0x82c108	0x43b530	0x43a930	0x203
GetConsoleMode	-	0x82c10c	0x43b534	0x43a934	0x1ff
ReadFile	-	0x82c110	0x43b538	0x43a938	0x475
GetFileSizeEx	-	0x82c114	0x43b53c	0x43a93c	0x24f
SetFilePointerEx	-	0x82c118	0x43b540	0x43a940	0x525
ReadConsoleW	-	0x82c11c	0x43b544	0x43a944	0x472
HeapReAlloc	-	0x82c120	0x43b548	0x43a948	0x34f
FindClose	-	0x82c124	0x43b54c	0x43a94c	0x178
FindFirstFileExW	-	0x82c128	0x43b550	0x43a950	0x17e
FindNextFileW	-	0x82c12c	0x43b554	0x43a954	0x18f
IsValidCodePage	-	0x82c130	0x43b558	0x43a958	0x38f
GetACP	-	0x82c134	0x43b55c	0x43a95c	0x1b5
GetOEMCP	-	0x82c138	0x43b560	0x43a960	0x29a

Digital Signature Information

»

Verification Status	Failed
Verification Error	The signature hash does not match the file contents

Certificate: Gary Kramlich

»

Issued by	Gary Kramlich
Parent Certificate	Sectigo RSA Code Signing CA
Country Name	US
Valid From	2021-03-22 01:00 (UTC+1)
Valid Until	2024-03-22 00:59 (UTC+1)
Algorithm	sha256_rsa
Serial Number	F6 AD 45 18 8E 55 66 AA 31 7B E2 3B 4B 8B 2C 2F
Thumbprint	AD FA 74 4A A0 74 FB 5D C5 7E E6 44 5A 3E 18 D6 06 C7 BF 96

Certificate: Sectigo RSA Code Signing CA

»

Issued by	Sectigo RSA Code Signing CA
Parent Certificate	USERTrust RSA Certification Authority
Country Name	GB
Valid From	2018-11-02 01:00 (UTC+1)
Valid Until	2031-01-01 00:59 (UTC+1)
Algorithm	sha384_rsa
Serial Number	1D A2 48 30 6F 9B 26 18 D0 82 E0 96 7D 33 D3 6A
Thumbprint	94 C9 5D A1 E8 50 BD 85 20 9A 4A 2A F3 E1 FB 16 04 F9 BB 66

Certificate: USERTrust RSA Certification Authority

»

Issued by	USERTrust RSA Certification Authority
Parent Certificate	AAA Certificate Services
Country Name	US
Valid From	2019-03-12 01:00 (UTC+1)
Valid Until	2029-01-01 00:59 (UTC+1)
Algorithm	sha384_rsa
Serial Number	39 72 44 3A F9 22 B7 51 D7 D3 6C 10 DD 31 35 95
Thumbprint	D8 9E 3B D4 3D 5D 90 9B 47 A1 89 77 AA 9D 5C E3 6C EE 18 4C

Certificate: AAA Certificate Services

»

Issued by	AAA Certificate Services
Country Name	GB
Valid From	2004-01-01 01:00 (UTC+1)
Valid Until	2029-01-01 00:59 (UTC+1)
Algorithm	sha1_rsa
Serial Number	01
Thumbprint	D1 EB 23 A4 6D 17 D6 8F D9 25 64 C2 F1 F1 60 17 64 D8 E3 49

Memory Dumps (9)

»

Name	Process ID	Start VA	End VA	Dump Reason	Bitness	Entry Point	Actions
chiefkeefofficialnaxyi_crypted(6).exe	2	0x00400000	0x008C6FFF	Relevant Image	32-bit	0x0040BE2E	... Memory Dump Actions Go to Process Download Dump
buffer	2	0x00112384	0x00112B01	First Execution	32-bit	0x00112505	... Memory Dump Actions Go to Process Download Dump
buffer	2	0x02320000	0x023B1FFF	Content Changed	32-bit	-	... Memory Dump Actions Go to Process Download Dump
buffer	2	0x009B0000	0x009B0FFF	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Download Dump
buffer	2	0x009CDC58	0x009CDCE7	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Download Dump
buffer	2	0x009D1510	0x009D230F	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Download Dump
buffer	2	0x009D2318	0x009D2537	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Download Dump
buffer	2	0x009D6E90	0x009D7E8F	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Download Dump
chiefkeefofficialnaxyi_crypted(6).exe	2	0x00400000	0x008C6FFF	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Download Dump

C:\Users\RDhJ0CNFevzX\AppData\Roaming\34432.exe

Dropped File

Binary

»

MIME Type	application/vnd.microsoft.portable-executable
File Size	2.26 MB
MD5	04f6704bd3ab97905a497baf3d7fdb3c
SHA1	7d216c427af6199d119b1c5a0cc93bdb724af669
SHA256	39630aaf0e17aa1929b5cf2f4340c22f22fa6f8f6d76f8398c288bff972b95fa
SSDeep	49152:x/HcwvGPAc5un0WVlI4UY5WmWBNkheV9qeAhpC9c4E3aT:RcwePj5un1l1M/C2PsaT
ImpHash	-

File Reputation Information

»

Verdict	malicious
Names	Mal/Generic-S

PE Information

»

Image Base	0x140000000
Size Of Code	0x241600
Size Of Initialized Data	0x600
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.amd64
Compile Timestamp	2022-03-24 19:20:47+00:00

Version Information (10)

»

Comments	Google Chrome
CompanyName	Google Inc.
FileDescription	chrome.exe
FileVersion	70.0.3538.110
InternalName	34432.exe
LegalCopyright	Copyright 2017 Google Inc. All rights reserved.
OriginalFilename	34432.exe
ProductName	Google Chrome
ProductVersion	70.0.3538.110
Assembly Version	0.0.0.0

Sections (2)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x140002000	0x2414f0	0x241600	0x200	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	7.99
.rsrc	0x140244000	0x5f8	0x600	0x241800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.26

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	YARA	Actions
34432.exe	4	0x140000000	0x140245FFF	Relevant Image		64-bit	-		... Memory Dump Actions Go to Process Download Dump
buffer	4	0x1BB10000	0x1BD39FFF	Reflectively Loaded .NET Assembly		64-bit	-		... Memory Dump Actions Go to Process Download Dump

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Modified File

Stream

»

MIME Type	application/octet-stream
File Size	2.16 KB
MD5	661cf24720eefe6b9a7179a5da74dcea
SHA1	f67077f77b13ef8a3ee2ddea26f9b38e87850677
SHA256	715ff57d4c75b4a1ae70218f9b70ec0341ba0a702944ccbbe6e2ed8d6db4873e
SSDeep	48:yHSdSM7gcL7g9GAl2UKcZkzyzSKhABzyziLBzyzzGHBXPC5n:yil7gcL7g9GAl2UKskzyzSKaBzyziLB4
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6fe77092-4798-42ae-bda5-e7f822b580e9

Modified File

Stream

»

MIME Type	application/octet-stream
File Size	1.16 KB
MD5	9832b59b183bb6318e62f1385d345c6d
SHA1	54b856a180fb3723403f9aad24ca548de63dc376
SHA256	bfd60204585f1603ee9faac7c44adb9fcd6fa56b7748f03ecb1a9beaa7c56ea1
SSDeep	24:WM83yV+ty+qXlIZXxf/DXdQXPZX3X6S+Z+Wz+q:BSy8PilIhNTWPhn6lgDq
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_da21122d-ae44-4f93-ba1d-c9a978ca5b20

Modified File

Stream

»

MIME Type	application/octet-stream
File Size	10.76 KB
MD5	8845f276e426accd51223008b6aed4bf
SHA1	c9fa81aa57e7c32c4bcefd33788967cc3170fe91
SHA256	72831bc6962c8017ea71abc038a8f60e79976ebaf05d363c80f32c975a55d0d9
SSDeep	192:8wUOJGqwAf5CBbXuQuxs0B8HX64MnENxUyrTEAsr9jQ0uwm/CgGZYySo0nbSRNNo:8wUOJGqwARCBbXxss0B8364MnENxUyr3
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_cc38888a-7080-4220-9b7d-de7a9b2167ba

Modified File

Stream

»

MIME Type	application/octet-stream
File Size	1.77 KB
MD5	c9fa9488f8854802c6f5eff3234d8a8a
SHA1	8b9029e83008d74b8c5414a2ef064629a340c9ae
SHA256	12bd362291f72f2c2e7756742b7377549d13d5bf231455d23ef250c5bdf18121
SSDeep	24:WM83yV+ty+ZcnPZcMGcZcFc7Vc4vcEvcXc6c4ncSZncJ5S+Z+Wz+q:BSy8PiPiMLim64EEEM34cYcJ5lgDq
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6de40067-cd2a-4666-8cd9-870e0a588215

Modified File

Stream

»

MIME Type	application/octet-stream
File Size	1.60 KB
MD5	5c8ce5ee94c705d5cf9c9f9ff4ba54a6
SHA1	6266e20e86de3b206706e66c108982166828c7f4
SHA256	b0ada1a5b9cd3c6c3c9fa895bf63665129ea3ac1be1391a2064296fdf950fe3a
SSDeep	24:WM83yV+ty+hXpDXTX8XAX8X+XpZX4qXpoPXSJMeS+Z+Wz+q:BSy8Pppbr848Oph4ip2SJplgDq
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f9e52a2e-51b0-4ce6-9de0-3959d95ded6e

Modified File

Stream

»

Also Known As	C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_01c28806-e5ae-41cc-b284-e627e1b02beb (Modified File)
MIME Type	application/octet-stream
File Size	602 Bytes
MD5	0f67d493e524af85928b059770f45ee1
SHA1	dbb7a768710941631e09c9baae697a95dd5b2004
SHA256	9214d80f84cede2f6a2b72f617e0c6a54c75f589b00ff17d2858041e541f30b0
SSDeep	12:Whi8fvy8k+DF5NFk+DFQCf1fx5Elk+DFRck+DFMak+DFQ:WM83yV+ty+L15eS+Z+Wz+q
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_67a2505d-bf00-4e2f-b010-406d32caddc3

Modified File

Stream

»

MIME Type	application/octet-stream
File Size	8.73 KB
MD5	de26212a79e7c70ea65871ce7c0142bb
SHA1	0ff4743454228ffabbad8cdacda16726baad110c
SHA256	bff972df82ef871cff56b4093f6953a526992555c2913ecd6fede0d642b7cc0a
SSDeep	192:ScPcWHBxheQYm2/ivkcBRc/hy2fZxy7GkiZ2HGjh1E4LQjNKZWLq5kbMyD41vLSe:ScPcWHBxheQYm2/ivkcBRc/hy2fZxy7U
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\x4g0yyrm.yrp.ps1

Dropped File

Stream

»

Also Known As	C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\2zulbano.ymn.psm1 (Dropped File) C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\atg3pfih.qmd.ps1 (Dropped File) C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\nhtbl0vg.oqs.psm1 (Dropped File)
MIME Type	application/octet-stream
File Size	1 Bytes
MD5	c4ca4238a0b923820dcc509a6f75849b
SHA1	356a192b7913b04c54574d18c28d46e6395428ab
SHA256	6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SSDeep	3:U:U
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_35cafaf5-03f2-42a2-93c9-176611e1b15a

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	690 Bytes
MD5	02ba9f1a8669357578a326bad8d229bd
SHA1	ed130b635cdb3b7b5ca3e739bb66378a893f879d
SHA256	4985daa10ab2e4770670a38d5cd2a15c3fd7cd1c8ed679d202a5e9e09b983fc3
SSDeep	12:Whi8fvy8k+DF5NFk+DFQCQURsc/CRElk+DFRck+DFMak+DFQ:WM83yV+ty+cUicKWS+Z+Wz+q
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_04225cbb-d96f-4dc7-adf1-f8d1760f2748

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	974 Bytes
MD5	0ff3dac1effeeb9b48453809444a196d
SHA1	15761e1dc00f8a5ecdcbce3054da3ac69a9650a5
SHA256	627e6b88e61562ed24ee216f5153264bbd7bb259605f2f9f89beed3c4aefca57
SSDeep	12:Whi8fvy8k+DF5NFk+DFQCzsc/tQsc/ESQsc//kQsc/KjgrElk+DFRck+DFMak+DO:WM83yV+ty+ccZccOc0cyjbS+Z+Wz+q
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_0c0b8ee4-e605-4bc0-a33a-4cb3dc447974

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	693 Bytes
MD5	73b0e01a7a7526d445d73cbcf5758473
SHA1	83499c3ab308b139872da6a48da45b491f749c08
SHA256	d4047357a1edf5d34dafe49e58d3023d40fda12732c9e7e7e65fa6769e7aacf4
SSDeep	12:Whi8fvy8k+DF5NFk+DFQCvw/xX/zq/x5Elk+DFRck+DFMak+DFQ:WM83yV+ty+jUX7GeS+Z+Wz+q
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_67d62fa6-fc88-4ec3-88c2-3552f80eed04

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.41 KB
MD5	1d76cc3e9a2f1c829171d3359a413583
SHA1	0eb028bb1a7258b92c16e299852a6fb729cf2ddd
SHA256	a5e8bab64392a30b85f5cb93bbe3b35cc981c61bc6d4dd16d25bcc734dc0e312
SSDeep	24:WM83yV+ty+e+gicQSgicZc6Lg6ZXrZXxZXr/1q/aS+Z+Wz+q:BSy8PK/u/i6Lg6hrhxhr/1CalgDq
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\035feb13ecf1f3145b7745a75a2e1a75\RDhJ0CNFevzX@XC64ZB_en-US_2022_03_27_03_52_17@v1.3.1\Screenshot.jpg

Dropped File

Image

»

MIME Type	image/jpeg
File Size	106.05 KB
MD5	ab328e755b0d23eaf9a07f7e4551eb2d
SHA1	bd185220c1e2ef087a8d0e3e9bca4aa823532ea6
SHA256	11926ea1d04cd83e8d8f279ce0c333700c0f68c796c7b4b95ab7b1edf5f0ae22
SSDeep	3072:OGHDBBzcxe6o9NQh9f2BnlMSq7rk+gjB42lZ:XBz2e6oQhelhzbjB4I
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d59564cf-b104-4c7d-9004-001b825e68ce

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1016 Bytes
MD5	3f603c68feb394f597450be08dd1baf0
SHA1	0ffb46e23a6d3aa0ce7b76838d13093b6c586d1f
SHA256	2a761c02935a44d0f783cfb34aee5b514864da12336527781fa0b341518a9e07
SSDeep	12:Whi8fvy8k+DF5NFk+DFQCqeYsc/Pfsc/5sc/Tfsc/dEElk+DFRck+DFMak+DFQ:WM83yV+ty+bckcCc70cltS+Z+Wz+q
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\035feb13ecf1f3145b7745a75a2e1a75\RDhJ0CNFevzX@XC64ZB_en-US_2022_03_27_03_52_17@v1.3.1\Information.txt

Dropped File

Text

»

MIME Type	text/plain
File Size	490 Bytes
MD5	2587c2e14fc795ad26ebb300cbf5c26c
SHA1	9e2c244d1f93fb2937a6d42e6dc6032254679324
SHA256	6266593b76382944b47bcb405d8bab9d3ea60d3640c8e99bc6d06dd9ba0d7db2
SSDeep	6:0MS55ZbINs3AiybNSc9c4BjeGBf3tiVvS1JZx2Cuvse4vzWYYrkxz2QJNDqGrSKR:0M4MmQPPk1V+2ht4qYv5jDJhTr65VO
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c2e444a1-a8cf-4642-84d4-bf6b49447700

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.86 KB
MD5	c5e62c945c61ce303ccca95dae891b0c
SHA1	fafec33b99109b183511f452b1c08abb71b01e96
SHA256	6b6c06abd51531f3f2129e3927074b7df0624435d9fc652883b6e2b57fc6db02
SSDeep	24:WM83yV+ty+tcKc5NcpKEcfc2c6A2cmcTc+cqIcOIc89xXo5eS+Z+Wz+q:BSy8PuH5Ok107HrQjqhOh8HLlgDq
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_743373ac-59ce-4f0d-866c-dfe07f42ee30

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	805 Bytes
MD5	248e176e21e4389b2659b625ce6f0af3
SHA1	49fffdc7df666f18efe2e50190f01f411919dfd0
SHA256	a68d471f739180f6a0d670ce4757471eb527a06628bfaed1fa9c8507d0366a63
SSDeep	12:Whi8fvy8k+DF5NFk+DFQCcxX/4xX/Fx5Elk+DFRck+DFMak+DFQ:WM83yV+ty+IX4XTeS+Z+Wz+q
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_faf4cf84-0480-4120-a4e7-df44a75895d1

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	805 Bytes
MD5	8090ce324ea533bf52bcbb068dc076ff
SHA1	b0f9e48018d74d96948d145fd5bcb5bf9b78f521
SHA256	c9d60721420164ef6d1707b4868440e9a90f3a3f36defbd14ff7f25ba55652d7
SSDeep	12:Whi8fvy8k+DF5NFk+DFQCFxX/cxX/4x5Elk+DFRck+DFMak+DFQ:WM83yV+ty+XXkX4eS+Z+Wz+q
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dc1db2eb-0493-4424-b2cc-9326164d47fe

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.78 KB
MD5	574e43743e90b95153069cfc68133112
SHA1	5184c6b808f1e29f799b070a03f536b2d9624f5b
SHA256	5d27dc383f4de3692eadfb15e7ad30b523113c59e6ae595a8451385f4edb739a
SSDeep	96:0P7I9Tw7AktykOKeULetbSmKJMi+zSwVqbiNSS4xtaUFiD621wZWk3lgDq:yIZwUktykOKeULetbSmuMBzSwVqbGSSg
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e819a753-bfee-41cc-87e9-7a88fcadf60e

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.84 KB
MD5	728e8b3a43766286274b180844a84ae4
SHA1	6a00f2dfd4e937b2873b60dad51651cb4e549609
SHA256	81b1dfc80a53d710a45845c2ceac7a921b3d2b5033a705ae2ddbe62773ba6256
SSDeep	24:WM83yV+ty+QUXYEgXgZXe64FX0X+XpX0JXtXiX0X9IzFXnEzFeS+Z+Wz+q:BSy8PXYrghSUOxqtaU9IxvlgDq
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_07198b07-5f67-4979-b796-a52fe0942b9c

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.27 KB
MD5	0fd6912530b8d85a0e732807967a03d1
SHA1	7ae9f1f14f6261299048a49450a2b473778e909d
SHA256	1c6d2138e5de6c498ce47beaa181f5717420306bfffc174c75d7b2f7d9bdddcf
SSDeep	24:WM83yV+ty+fpcFpcfpcUpczpczpceUpcHPS+Z+Wz+q:BSy8PfyFyfyUyzyzyeUyHPlgDq
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e9866120-4b16-4ca2-9e66-af55aa604142

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	3.79 KB
MD5	af5ae9c3b1db881ec961cc0848ed35a3
SHA1	422d1aafdd1db7e6f9605ed66f663480f5dc228b
SHA256	34ed6390a3bc4bc2e0e7fa5c8e4623e59d88ad14e14b96513d812689493be057
SSDeep	96:0P2E9LwZW3wvjzlWYYlpLrY0Mzb16fLfLKJ0yn/lgDq:q9LwZW3wvjzlWYYlpLrY0Mzb16fLfLKR
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8e96ee40-6b35-47dc-81d5-b2d5c2e260b3

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.89 KB
MD5	b9233c71cda412a16a3dbaaddfbe2665
SHA1	97b959aaa4373dc24d6d47e39e04e014d3ead212
SHA256	91963953d5bab4cf5d8b01acaf5f39e809e32567ec8794e810566e8402e220c7
SSDeep	48:BSy8P4tIKOy8xC83dLFQ5k4l+tQT9T8AJ97Kg9zf7u52lgDq:0PqIKODwIdLF2k4l+6T9T8AJ97Kg9zft
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3f4f516c-24cd-4f8d-980a-b1ceaf0436fb

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.68 KB
MD5	3d108825a816fb937ef45d971436e6b7
SHA1	17bcff30a74209abc2d6c3e7aa851bafb1f7e624
SHA256	76c34383567254ed170d26f68c07adb09a8de40be537c45eb65ef971bf6073ec
SSDeep	24:WM83yV+ty+4XIX6kXzX8bdX7X94QXPXwnXGPXIpXuKeS+Z+Wz+q:BSy8PwAnL8hz+IfAGf0ClgDq
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\035feb13ecf1f3145b7745a75a2e1a75\DotNetZip-nxtjuzlo.tmp

Dropped File

ZIP

»

Also Known As	C:\Users\RDhJ0CNFevzX\AppData\Local\035feb13ecf1f3145b7745a75a2e1a75\RDhJ0CNFevzX@XC64ZB_en-US_2022_03_27_03_52_17@v1.3.1.zip (Dropped File)
MIME Type	application/zip
File Size	117.85 KB
MD5	5a753c9af2452174b03d7b88ced581a6
SHA1	c86225647cf9092e75cc99ea04828f4c91bb62f0
SHA256	a5e27fe611d73d0417bc898b0ed4fccad39537fc5145a0b4d7e1122fb2c504fc
SSDeep	3072:UxmgPYXez2Ni8rGjZxF0YDawxXhf/JD1V:UogU/U8rGn7DacRDj
ImpHash	-
Error Remark	No password was provided for this password-protected sample.

C:\Users\RDhJ0CNFevzX\AppData\Local\035feb13ecf1f3145b7745a75a2e1a75\msgid.dat

Dropped File

Text

»

MIME Type	text/plain
File Size	12 Bytes
MD5	6cef6210a655582a91dc051fab2f4f02
SHA1	af3bba2ed8188c19de8529ee87eb8faac1fcd7f3
SHA256	7ec10e1f7b8964b9ec7303ccd3a6aebf1d23bb79cb7e697ccbbae34e4aebb88c
SSDeep	3:hSuH:h5
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.16 KB
MD5	4d370289ee37f859d8e7484889992b81
SHA1	ff6d4437bdef49901b0de5a2fd2b680c8bcd49a1
SHA256	29840f7d4b32ed407f31512557810a94139d863cf9cd103e3c191e74babc9046
SSDeep	48:yHSdSM7gbL7g9GAl2UKcZkzyzSKhABzyziLBzyzzGHBXPC5n:yil7gbL7g9GAl2UKskzyzSKaBzyziLB4
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.16 KB
MD5	9642f05799d65c6fc6cacf89f183c214
SHA1	c63f9b33a307f63b8ece37201a77e38090e88276
SHA256	8654c22b21a114cb105203eace56e22969b294667050d876f2ddbb82914bd5dd
SSDeep	48:yHSdSM7gbL7g+GAl2UKcZkzyzSKhABzyziLBzyzzGHBXPC5n:yil7gbL7g+GAl2UKskzyzSKaBzyziLB4
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.16 KB
MD5	2c51102678d11b6232a6ddeb3073ca88
SHA1	b400f6c9f4394e24c19134f99636b0f35ecffc59
SHA256	c48d5f650e77d2cca28123402a3076d1b60254a04e2c832efb4f46ea86b1c142
SSDeep	48:yHSdSM7gbL7g+GAl2UcZkzyzSKhABzyziLBzyzzGHBXPC5n:yil7gbL7g+GAl2UskzyzSKaBzyziLBzU
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.16 KB
MD5	48b76d5756c78c308b0d30e834ad8aff
SHA1	b65fa6abeccbe9400d90702dea1c1ebe0ac96077
SHA256	0b39a46f94e089fc5f2b3c9f445865ad41c58f63c10aa56606f0dda146d3757d
SSDeep	48:yHSdSM7gbL7g+GAl2UcZkzyzUhABzyziLBzyzzGHBXPC5n:yil7gbL7g+GAl2UskzyzUaBzyziLBzy5
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.16 KB
MD5	17d523f6e162eaed0a12a323882860f5
SHA1	88ba4cb66086cd763bc7e4e841a1b0ae2d6cfb5c
SHA256	23a05b3034f9d99dc1fc23bca8848e0baaaf8bd3660892915cdf2052be7be86b
SSDeep	48:yHSdSM7gbL7g+GAl2UcZkzyzUhABzyz7LBzyzzGHBXPC5n:yil7gbL7g+GAl2UskzyzUaBzyz7LBzy5
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.16 KB
MD5	3e822371c39f7d7d4e507ed4f15246c1
SHA1	71090d3dfb1f7953e38dc4b5995c8e8dea49ad97
SHA256	b5eafc0d8738aa0243f9062d409955480186a368e9cb3c67f37aa067a2f8409d
SSDeep	48:yHSdSM7gbL7g+GAl2UcZkzyzUhABzyz7LBzyzaGHBXPC5n:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyS
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.16 KB
MD5	d8149bab08b0a612220198370ae020bf
SHA1	87cfa3001a78596c5df620fbeb40369befee3cfd
SHA256	4ab3408745ed549ae0e65c6f8b8095698e4cca8cdd9152901c6025d733fe8d12
SSDeep	48:yHSdSM7gbL7g+GAl2UcZkzyzUhABzyz7LBzyzaGHBXM5n:yil7gbL7g+GAl2UskzyzUaBzyz7LBzy8
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.42 KB
MD5	1c3481daa0a29d409d09967c4e10eaad
SHA1	539a6b77fe00b1041a4b968e344649e647e4ee67
SHA256	c0e001b1ee5b7b2b7540944a707f5a25f263494c8258d5fca2e0d74f369d6454
SSDeep	48:yHSdSM7gbL7g+GAl2UcZkzyzUhABzyz7LBzyzaGHBXM5T9yYbDn:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyW
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.70 KB
MD5	ab35ae2815a0539f2eb16d5a84b953da
SHA1	6fda01d7c2f9aede8dad893fc409c21f261f111e
SHA256	268c5302ba88eb63c72a53521aa789795105c69e03aa35b0bf5d5b11426007ba
SSDeep	48:yHSdSM7gbL7g+GAl2UcZkzyzUhABzyz7LBzyzaGHBXM5T9yYbzDsP+n:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyq
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.97 KB
MD5	8af963abc93af53c978b8b213d6d04ff
SHA1	42f81b6c6a438853d6e8ba3c272060747d0e5d68
SHA256	7ee6257f3d71e64b2f64b8e5d7ae8ef7da7c4b4832112c775e0bbe1ada9b12e3
SSDeep	48:yHSdSM7gbL7g+GAl2UcZkzyzUhABzyz7LBzyzaGHBXM5T9yYbzDsPq7O+Jan:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyd
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\035feb13ecf1f3145b7745a75a2e1a75\RDhJ0CNFevzX@XC64ZB_en-US_2022_03_27_03_52_17@v1.3.1\Grabber\Users\RDhJ0CNFevzX\Desktop\UJaeOBQUW7h.rtf

Dropped File

RTF

»

Also Known As	C:\Users\RDhJ0CNFevzX\Desktop\UJaeOBQUW7h.rtf (Dropped File)
MIME Type	text/rtf
File Size	15.93 KB
MD5	10950a0b5a1cf5c8c82ab63d227918dc
SHA1	8aab91020cae5c4c11114ef3900de81dce40c980
SHA256	518f19f458d73ba92e9be69e7263b4ecc34f857e6334f8a6963da3a0c9cc87d9
SSDeep	384:Gai6MZY5GkXzhmvbzq0tHMMboEydpFLfcA+D:GT6kMJEnPlMnEydLL3U
ImpHash	-

Office Information

»

C:\Users\RDhJ0CNFevzX\AppData\Local\035feb13ecf1f3145b7745a75a2e1a75\RDhJ0CNFevzX@XC64ZB_en-US_2022_03_27_03_52_17@v1.3.1\Software.txt

Dropped File

Text

»

MIME Type	text/plain
File Size	4.36 KB
MD5	7bc8834e42df289322e27ca488d50492
SHA1	ed82bc52cafca9b06c8ba5ec93f6e121df44d3b7
SHA256	9f5ace47fce9330fd0d5341db52e2e23bb471852a408e0394de2ff8a92d12382
SSDeep	96:9dbAVNpcCIDpqAr8VtWzBVJumL8uCLP0TbUm+Szm+n08yRoS2j1epBj28JtLzNV4:8aEO386zs8uvHJl/N47wc8WGK9
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	3.22 KB
MD5	8f6e52b0b030c349a8b6ccf7eea796ee
SHA1	3fd9f9e65cd2eb892fa721444d9b0e861caedcf6
SHA256	97c25cef5780e8f8e23709172c4cb80c7feaae4773daedc3a069394a3f1d2579
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJC:yEMLxFZsiaiLzSiZxHkq/AJC
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	3.46 KB
MD5	68c5529fae2aa8c790f0a20c33d40d87
SHA1	60e5322a918cec776b03268586b753a167e719cc
SHA256	610c020a6630bbf8fd67026e10a1b00cb5a75350153eb634a8cc4fcf6c6d1b6c
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ri:yEMLxFZsiaiLzSiZxHkq/AJO9v
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	3.68 KB
MD5	3fbce62cb301a77b5e897f60735cb8c9
SHA1	0ba54afd1c0d25259ddb2ac229a2bb35cbdc9c57
SHA256	e98f96bc9cc0cb467606b075adad021640901fb8ed2792f452c3d082c01ad9b4
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ruGF3:yEMLxFZsiaiLzSiZxHkq/AJO9PGV
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	3.93 KB
MD5	c38921564e1b293aff6672d5a8e781ea
SHA1	feda1113d30c00031a068a1d0d3de53b49121fc4
SHA256	5eb7ecc9e79cfb71426f77125f013ce3d4f2f6cd470615cd4b555b0dc4881e31
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ruGFnsb:yEMLxFZsiaiLzSiZxHkq/AJO9PG1sb
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.17 KB
MD5	236569b882eca3d8d6e529d56713af0f
SHA1	58c6f0cd878f851bf20ef3dfe317b0166fef5501
SHA256	f7b73c4cc75d940b5ed2332660234f8a05936ad8e5ddbdeb3aa5265d2b038b24
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ruGFns7Q:yEMLxFZsiaiLzSiZxHkq/AJO9PG1s7Re
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.40 KB
MD5	1072a772bcea66a5e8650b4ef0f6b880
SHA1	fc1ca38b2a1c247fa5b9e3bbd0aaeaa033ac4682
SHA256	0038b9cde1fa23b0219085e1dd4b1343919e1eddc8efd86b6f76d247e2ddfaca
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ruGFns7u:yEMLxFZsiaiLzSiZxHkq/AJO9PG1s7Rs
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.64 KB
MD5	d00468337c90b0645b7b7ba612efc4c7
SHA1	8e4f76762d58f9bb8df7a9b6dc7b96d05dd18d11
SHA256	6fb6f5fbef8875bf2c6b3d0c73bd08c88ca2b5a5649210c4fa444402bd07711e
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ruGFns7p:yEMLxFZsiaiLzSiZxHkq/AJO9PG1s7Rf
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.88 KB
MD5	f5521427d060eb521b8b1f68897eb6ea
SHA1	c034775c0a3a1ef0c3b1852deb3ea848965c8506
SHA256	0d0cddc8dc2834c30059028fc51598af7fca64a984bb7236f54a145c361d390a
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ruGFns7q:yEMLxFZsiaiLzSiZxHkq/AJO9PG1s7RA
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	5.11 KB
MD5	4f4cccd3c4bdf046991f9aaf296cc411
SHA1	47e1d6bd6df5ed3d2ff9894f14fee2fdbe3d6728
SHA256	91f04c98828ee74e2f76618278e9693fd01b1a823ce0ed4824e8b4a30d9462a2
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ruGFns7u:yEMLxFZsiaiLzSiZxHkq/AJO9PG1s7Rk
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	5.35 KB
MD5	e3c454df5672cf24e5a9c23e5f777b41
SHA1	5b28b7a438b0c79846fb166290f69191ff8d9750
SHA256	55708031c12bb04d19981dc1a4d7f2965906f6147e283c18630a48ba84c2dd9a
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ruGFns77:yEMLxFZsiaiLzSiZxHkq/AJO9PG1s7R5
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	5.58 KB
MD5	21d9e4a9305e2007a6c6297d1e784388
SHA1	ea0e3fe4bc12263d019be68f92bbfe29d224b79c
SHA256	33358d3e64c84de81a2f1b2f2d01324737aaa06e0b417991945e45ae95e11802
SSDeep	96:yil7gbL7g+GAl2UskzyzUaBzyz7LBzyzaGHBXMZ9yYHDsPq7O+AJOgQ8ruGFns7t:yEMLxFZsiaiLzSiZxHkq/AJO9PG1s7Rf
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\035feb13ecf1f3145b7745a75a2e1a75\RDhJ0CNFevzX@XC64ZB_en-US_2022_03_27_03_52_17@v1.3.1\Processes.txt

Dropped File

Text

»

MIME Type	text/plain
File Size	9.22 KB
MD5	3c556623c8a200e2c4d97066f6f013d9
SHA1	7b640f41a4555f725c688a7da30f9dba3e993f72
SHA256	6e351b8c534fb7fa3e57ceeb8631f6dc0a260993802c4db1237ce2faadd9d6cc
SSDeep	192:c9+mxUaukZWqo5s+cYwrbxOnrbIk91USf:9OZq6+obxOPIk9GSf
ImpHash	-

C:\Users\RDhJ0CNFevzX\AppData\Local\035feb13ecf1f3145b7745a75a2e1a75\RDhJ0CNFevzX@XC64ZB_en-US_2022_03_27_03_52_17@v1.3.1\Windows.txt

Dropped File

Text

»

MIME Type	text/plain
File Size	827 Bytes
MD5	2ec9d0521a1ed7d5822c97e5564affce
SHA1	f1d998094a931b0d184f7c87085a313bdf78286c
SHA256	456853e6f255ed9caed715fbe43cc5ede55e516d51d15d9159a0b36126d5537b
SSDeep	12:B+FfR93a6XoIrDzEv9JR1uYi+Cy/TTUR1giiEXYR1u9+0dAlAR1opiz7ggR1u4/A:B+1q64IrDzG9drb6X84Dl+izzzyqDHw
ImpHash	-

Remarks (1/1)

There are no files for this filter

There are no files in this analysis

Classifications

Threat Names

WHOIS Domain Information

Before

After