Benign windows Download

Flowseal.TGWSProxy

Keyboard hook enumerates windows for exfilPE carries ransom note, payment demand or ransom extension

SHA-256b51436e8960307316135e64ac14753b1f3b0e7a46afe1bd6081353b82de20f09

URLhttps://github.com/Flowseal/tg-ws-proxy/releases/latest/download/TgWsProxy_windows.exe

MaleculeK₂(Li₁₄Mc₃)O₁₃(Co₂I₄Al₃As₁₄C₉CaDy₃Er₁₀La₂P₂PrS₂Xe)H₁₁(Cm₄₁Cr₁₉Db₂₄Ds₂F₃₅Hf₈Mg₈Os₃₄Po₃₃Ti₃U₆)Md₈(Bi₂₆Bk₂In₁₅Pa₄PmPt₂Si₄)Th

Evidence

PyInstaller script execution error 0x2bcb0–0x2bda0

⋯3 more rows
0x2bce02066696c652e0a000000000000000000 file...........
0x2bcf04600610069006c006500640020007400F.a.i.l.e.d. .t.
0x2bd006f002000650078006500630075007400o. .e.x.e.c.u.t.
0x2bd1065002000730063007200690070007400e. .s.c.r.i.p.t.
0x2bd202000270025006c007300270020006400 .'.%.l.s.'. .d.
0x2bd3075006500200074006f00200075006e00u.e. .t.o. .u.n.
⋯7 more rows

Convert SID to string representation 0x2bfd8–0x2c0a8

⋯3 more rows
0x2c0086f206578747261637420656e7472793ao extract entry:
0x2c0182025732e0a0000007472616365626163 %s.....tracebac
0x2c0286b00000000000000666f726d61745f65k.......format_e
0x2c0387863657074696f6e000000000a000000xception........
⋯7 more rows

PyInstaller contents directory option 0x2c378–0x2c508

⋯3 more rows
0x2c3a850795f47494c5f44495341424c454400Py_GIL_DISABLED.
0x2c3b87079692d72756e74696d652d746d7064pyi-runtime-tmpd
0x2c3c869720000000000007079692d636f6e74ir......pyi-cont
0x2c3d8656e74732d6469726563746f72790000ents-directory..
0x2c3e87079692d64697361626c652d77696e64pyi-disable-wind
⋯18 more rows

PyInstaller embedded PKG archive error 0x2c630–0x2c730

⋯3 more rows
0x2c6602d0038002e000a000000000000000000-.8.............
0x2c670436f756c64206e6f74206c6f61642050Could not load P
0x2c68079496e7374616c6c6572277320656d62yInstaller's emb
0x2c690656464656420504b4720617263686976edded PKG archiv
0x2c6a0652066726f6d20746865206578656375e from the execu
0x2c6b07461626c6520282573290a0000000000table (%s)......
0x2c6c0436f756c64206e6f7420736964652d6cCould not side-l
⋯7 more rows

PyInstaller MEIPASS runtime directory 0x2d01e–0x2d18e

⋯3 more rows
0x2d04e00004661696c656420746f2067657420..Failed to get 
0x2d05e5f4d4549504153532061732050794f62_MEIPASS as PyOb
0x2d06e6a6563742e0a000000005f4d45495041ject......_MEIPA
⋯6 more rows
0x2d0de74616c6c65725f70797a000000000000taller_pyz......
0x2d0ee000050595a206172636869766520656e..PYZ archive en
0x2d0fe747279206e6f7420666f756e6420696etry not found in
0x2d10e2074686520544f43210a000000000000 the TOC!.......
0x2d11e000025553f256c6c75004661696c6564..%U?%llu.Failed
⋯7 more rows