Windows Analysis Report
s.exe

Overview

General Information

Sample name: s.exe
Analysis ID: 1428469
MD5: f9faae7acc66819bafd5523f719d5c11
SHA1: c424f400216b27f0fdd919b39fb01920c6e2cfe3
SHA256: 4404c09ad18da9aba1945dfb2975e210ff96ab3698e5c075bd6c8ec57cf854cd
Tags: exe
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Contains functionality to infect the boot sector
Found pyInstaller with non standard icon
Hides threads from debuggers
Uses the Telegram API (likely for C&C communication)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A380F0 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext, 3_2_70A380F0
Source: s.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: class pdb.Pdb(completekey='tab', stdin=None, stdout=None, skip=None, nosigint=False, readrc=True) source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: s.exe, 00000003.00000002.3400842141.00007FF8A8ACC000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: Changed in version 3.2: ".pdbrc" can now contain commands that source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: s.exe, 00000003.00000002.3401939053.00007FF8B5729000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: s.exe, 00000003.00000002.3404422770.00007FF8B90FB000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: ucrtbase.pdb source: s.exe, 00000003.00000002.3403422407.00007FF8B80D1000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: s.exe, 00000003.00000002.3401939053.00007FF8B5729000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: Raises an auditing event "pdb.Pdb" with no arguments. source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: s.exe, 00000003.00000002.3402387778.00007FF8B61E6000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: commands as if given in a ".pdbrc" file, see Debugger Commands. source: topics.pyc.0.dr
Source: Binary string: If a file ".pdbrc" exists in the user source: topics.pyc.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: s.exe, 00000003.00000002.3399286880.00007FF8A7F80000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: ~/.pdbrc source: s.exe, 00000003.00000002.3396766134.0000020D36A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: import pdb; pdb.Pdb(skip=['django.*']).set_trace() source: topics.pyc.0.dr
Source: Binary string: placed in the .pdbrc file): source: s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pdb.Pdb source: s.exe, 00000003.00000002.3396766134.0000020D36A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: s.exe, 00000003.00000002.3403594861.00007FF8B8258000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: s.exe, 00000003.00000003.2306356375.0000020D35CD8000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395067334.0000020D35D5B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: will load .pdbrc files from the filesystem. source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: s.exe, 00000003.00000002.3399286880.00007FF8A8002000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc@B source: s.exe, 00000003.00000002.3396766134.0000020D36A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: s.exe, 00000003.00000002.3402387778.00007FF8B61E6000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: s.exe, 00000003.00000002.3404806293.00007FF8B9843000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: s.exe, 00000003.00000002.3399286880.00007FF8A7F80000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: s.exe, 00000003.00000003.2306356375.0000020D35CD8000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395067334.0000020D35D5B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: s.exe, 00000003.00000002.3405191896.00007FF8BA521000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: s.exe, 00000003.00000002.3404979801.00007FF8B9F70000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: s.exe, 00000003.00000002.3402793467.00007FF8B7836000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: .pdbrc source: s.exe, 00000003.00000002.3396766134.0000020D36A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: in the ".pdbrc" file): source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: s.exe, 00000003.00000002.3403199884.00007FF8B8002000.00000002.00000001.01000000.0000000F.sdmp, pyexpat.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: s.exe, 00000003.00000002.3401297091.00007FF8A8E1F000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: s.exe, 00000003.00000002.3404071756.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: s.exe, 00000003.00000002.3404422770.00007FF8B90FB000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: s.exe, 00000003.00000002.3404636449.00007FF8B93CD000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: ucrtbase.pdbUGP source: s.exe, 00000003.00000002.3403422407.00007FF8B80D1000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: s.exe, 00000003.00000002.3404243239.00007FF8B8F88000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: s.exe, 00000003.00000002.3394136082.0000020D33860000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: s.exe, 00000003.00000002.3402959420.00007FF8B78AD000.00000002.00000001.01000000.00000016.sdmp
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08843C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF68A08843C
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A0924D4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF68A0924D4
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A078B00 FindFirstFileExW,FindClose, 0_2_00007FF68A078B00
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08843C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF68A08843C
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI17722\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\s.exe Code function: 4x nop then push rbp 3_2_70A2BD40
Source: C:\Users\user\Desktop\s.exe Code function: 4x nop then push rbp 3_2_70A2BD40

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
May check the online IP address of the machine
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown DNS traffic detected: queries for: ipinfo.io
Source: s.exe, 00000003.00000002.3396866368.0000020D36B10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.../back.jpeg
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: s.exe, 00000003.00000003.2306356375.0000020D35CD8000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395067334.0000020D35D5B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: s.exe, 00000003.00000002.3394612305.0000020D358B0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000003.2276041019.0000020D3592C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: s.exe, 00000003.00000002.3397784430.0000020D37283000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: s.exe, 00000003.00000002.3394169314.0000020D338F9000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: s.exe, 00000003.00000002.3395514478.0000020D36349000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl%
Source: s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlU
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: pyexpat.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: s.exe, 00000003.00000002.3397130481.0000020D36E84000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: s.exe, 00000003.00000002.3395207574.0000020D35EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/unittest.html
Source: s.exe, 00000003.00000002.3395307424.0000020D35FD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/ActiveState/appdirs
Source: s.exe, 00000003.00000002.3397257790.0000020D36F74000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000003.00000002.3396078168.0000020D3652B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://goo.gl/zeJZl.
Source: s.exe, 00000000.00000003.2269130841.0000018CD4A7D000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36349000.00000004.00000020.00020000.00000000.sdmp, connectionpool.pyc.0.dr String found in binary or memory: http://google.com/
Source: s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: s.exe, 00000003.00000002.3395514478.0000020D36349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: s.exe, 00000003.00000002.3397257790.0000020D36F64000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es0
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: s.exe, 00000003.00000002.3395207574.0000020D35EB0000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395113642.0000020D35DB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3394979313.0000020D35D19000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397475070.0000020D36FD0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/
Source: s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/%
Source: s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/1
Source: s.exe, 00000003.00000002.3397475070.0000020D36FD0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/Z
Source: s.exe, 00000003.00000002.3397475070.0000020D36FD0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/ZIe
Source: s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tip.tcl.tk/48)
Source: s.exe, 00000003.00000002.3397130481.0000020D36DD0000.00000004.00001000.00020000.00000000.sdmp, ssl_match_hostname.pyc.0.dr String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3394612305.0000020D358B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es00
Source: s.exe, 00000003.00000002.3395207574.0000020D35EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: s.exe, 00000003.00000002.3397784430.0000020D37283000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: s.exe, 00000003.00000002.3397784430.0000020D37283000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/YA
Source: datetime.pyc.0.dr String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: select.pyd.0.dr, pyexpat.pyd.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397610478.0000020D370A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: datetime.pyc.0.dr String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: expatreader.pyc.0.dr String found in binary or memory: http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml
Source: __init__.pyc6.0.dr String found in binary or memory: http://www.megginson.com/SAX/.
Source: topics.pyc.0.dr String found in binary or memory: http://www.ocert.org/advisories/ocert-2011-003.html
Source: datetime.pyc.0.dr String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: s.exe, 00000003.00000002.3395514478.0000020D36349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps
Source: s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: s.exe, 00000003.00000002.3395514478.0000020D36349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cpsorr
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wwwsearch.sf.net/):
Source: s.exe, 00000003.00000002.3397910762.0000020D377E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/
Source: s.exe, 00000003.00000002.3397910762.0000020D377E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/C:
Source: s.exe, 00000003.00000002.3398111750.0000020D37AF4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/sendPhoto
Source: s.exe, 00000003.00000002.3398111750.0000020D37AF4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/sendPhotoPI
Source: s.exe, 00000003.00000002.3395514478.0000020D36349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module
Source: s.exe, 00000000.00000003.2142303141.0000018CD4A4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wiki
Source: s.exe, 00000000.00000003.2141087359.0000018CD4A47000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000000.00000003.2140423490.0000018CD4A45000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000000.00000003.2141672578.0000018CD4A4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/
Source: pyopenssl.pyc.0.dr String found in binary or memory: https://cryptography.io
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, results.pyc.0.dr String found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, results.pyc.0.dr String found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395207574.0000020D35EB0000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000003.00000002.3394809453.0000020D35BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html
Source: s.exe, 00000003.00000002.3394707171.0000020D35AB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: s.exe, 00000000.00000003.2143172845.0000018CD4A49000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dotcolon.net/font/aileron
Source: s.exe, 00000003.00000002.3396866368.0000020D36B10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: s.exe, 00000003.00000002.3395207574.0000020D35EB0000.00000004.00001000.00020000.00000000.sdmp, _musllinux.pyc.0.dr String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: s.exe, 00000003.00000002.3394169314.0000020D338F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: __init__.pyc23.0.dr String found in binary or memory: https://github.com/asweigart/pygetwindow
Source: s.exe, 00000003.00000002.3396866368.0000020D36B10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: s.exe, 00000003.00000002.3397257790.0000020D36F74000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: s.exe, 00000003.00000002.3395207574.0000020D35EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: pyopenssl.pyc.0.dr String found in binary or memory: https://github.com/kjd/idna
Source: s.exe, 00000003.00000002.3395413095.0000020D360E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packaging
Source: s.exe, 00000003.00000002.3395413095.0000020D360E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packagingEI17722
Source: s.exe, 00000003.00000002.3394809453.0000020D35C7C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: s.exe, 00000003.00000002.3396622802.0000020D367F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: s.exe, 00000003.00000002.3394349383.0000020D35210000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: s.exe, 00000003.00000002.3394169314.0000020D338F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: s.exe, 00000003.00000002.3394169314.0000020D338F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: s.exe, 00000003.00000002.3394169314.0000020D338F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: __init__.pyc1.0.dr String found in binary or memory: https://github.com/urllib3/urllib3/issues/2168
Source: s.exe, 00000003.00000002.3396866368.0000020D36B10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: s.exe, 00000000.00000003.2269130841.0000018CD4A7D000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: s.exe, 00000003.00000002.3396961678.0000020D36C20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: __init__.pyc1.0.dr String found in binary or memory: https://github.com/urllib3/urllib3/issues/3020
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3394809453.0000020D35C7C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: s.exe, 00000003.00000002.3395514478.0000020D36349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail/
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: s.exe, 00000003.00000002.3394809453.0000020D35C7C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/
Source: sessions.pyc.0.dr String found in binary or memory: https://httpbin.org/get
Source: s.exe, 00000003.00000002.3394809453.0000020D35BB0000.00000004.00000020.00020000.00000000.sdmp, __init__.pyc31.0.dr String found in binary or memory: https://httpbin.org/post
Source: s.exe, 00000003.00000002.3398406430.0000020D37B20000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000003.00000002.3398111750.0000020D37AF4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/json
Source: s.exe, 00000003.00000002.3398111750.0000020D37AF4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/json97.47MB
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000003.2307512558.0000020D3652C000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3396078168.0000020D3652B000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000003.2306614001.0000020D36596000.00000004.00000020.00020000.00000000.sdmp, request.pyc1.0.dr String found in binary or memory: https://mahler:8092/site-updates.py
Source: s.exe, 00000003.00000002.3396866368.0000020D36B10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mouseinfo.readthedocs.io
Source: s.exe, 00000003.00000002.3396622802.0000020D367F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: s.exe, 00000003.00000002.3401297091.00007FF8A8E1F000.00000002.00000001.01000000.00000006.sdmp String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: s.exe, 00000003.00000002.3395207574.0000020D35EB0000.00000004.00001000.00020000.00000000.sdmp, _musllinux.pyc.0.dr String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: s.exe, 00000003.00000002.3394809453.0000020D35BB0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397257790.0000020D36F14000.00000004.00001000.00020000.00000000.sdmp, __init__.pyc31.0.dr String found in binary or memory: https://requests.readthedocs.io
Source: s.exe, 00000003.00000002.3397257790.0000020D36F14000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://requests.readthedocs.io0
Source: s.exe, 00000003.00000002.3394809453.0000020D35BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: s.exe, 00000003.00000002.3397910762.0000020D377E0000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000003.00000002.3398111750.0000020D37AA8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/a/20982715/185510
Source: s.exe, 00000003.00000002.3396431054.0000020D365F0000.00000004.00001000.00020000.00000000.sdmp, _pygetwindow_win.pyc.0.dr String found in binary or memory: https://stackoverflow.com/questions/18905702/python-ctypes-and-mutable-buffers
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3394809453.0000020D35BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: s.exe, 00000003.00000002.3397257790.0000020D36F74000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: s.exe, 00000003.00000002.3396431054.0000020D365F0000.00000004.00001000.00020000.00000000.sdmp, _pygetwindow_win.pyc.0.dr String found in binary or memory: https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c
Source: s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3394809453.0000020D35C7C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: s.exe, 00000003.00000002.3396866368.0000020D36B10000.00000004.00001000.00020000.00000000.sdmp, connection.pyc0.0.dr String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: s.exe, 00000003.00000002.3396961678.0000020D36C20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: connectionpool.pyc.0.dr String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: s.exe, 00000000.00000003.2146462613.0000018CD4A4C000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
Source: s.exe, 00000000.00000003.2141087359.0000018CD4A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu
Source: s.exe, 00000000.00000003.2146462613.0000018CD4A4C000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20240227115053/https://exiv2.org/tags.html)
Source: s.exe, 00000003.00000002.3394612305.0000020D358B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: s.exe, 00000000.00000003.2142664041.0000018CD4A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cazabon.com
Source: s.exe, 00000000.00000003.2142664041.0000018CD4A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cazabon.com/pyCMS
Source: s.exe, 00000000.00000003.2142664041.0000018CD4A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.littlecms.com
Source: s.exe, 00000000.00000003.2143033759.0000018CD4A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdf
Source: s.exe, 00000003.00000002.3402459653.00007FF8B621B000.00000002.00000001.01000000.00000018.sdmp, s.exe, 00000003.00000002.3399511734.00007FF8A8079000.00000002.00000001.01000000.00000017.sdmp String found in binary or memory: https://www.openssl.org/H
Source: pyopenssl.pyc.0.dr String found in binary or memory: https://www.pyopenssl.org
Source: s.exe, 00000003.00000002.3394809453.0000020D35BB0000.00000004.00000020.00020000.00000000.sdmp, __init__.pyc31.0.dr String found in binary or memory: https://www.python.org
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000003.2306614001.0000020D36596000.00000004.00000020.00020000.00000000.sdmp, request.pyc1.0.dr String found in binary or memory: https://www.python.org/
Source: s.exe, 00000003.00000002.3395113642.0000020D35DB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: s.exe, 00000003.00000002.3394349383.0000020D35210000.00000004.00001000.00020000.00000000.sdmp, topics.pyc.0.dr String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: topics.pyc.0.dr String found in binary or memory: https://www.unicode.org/Public/13.0.0/ucd/DerivedCoreProperties.txt
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: s.exe, 00000003.00000002.3397475070.0000020D37016000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3397683443.0000020D37155000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: s.exe, 00000003.00000002.3395514478.0000020D361F0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A22B90: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, 3_2_70A22B90
Detected potential crypto function
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A079B9B 0_2_00007FF68A079B9B
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A096960 0_2_00007FF68A096960
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A077960 0_2_00007FF68A077960
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A0978AC 0_2_00007FF68A0978AC
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A083340 0_2_00007FF68A083340
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A097360 0_2_00007FF68A097360
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A096BDC 0_2_00007FF68A096BDC
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08843C 0_2_00007FF68A08843C
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A082484 0_2_00007FF68A082484
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A0924D4 0_2_00007FF68A0924D4
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A083CD0 0_2_00007FF68A083CD0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A088CC0 0_2_00007FF68A088CC0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A094D0C 0_2_00007FF68A094D0C
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A091528 0_2_00007FF68A091528
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A086520 0_2_00007FF68A086520
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08AA20 0_2_00007FF68A08AA20
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A088288 0_2_00007FF68A088288
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A082280 0_2_00007FF68A082280
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08EAA0 0_2_00007FF68A08EAA0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A094870 0_2_00007FF68A094870
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A082074 0_2_00007FF68A082074
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A082894 0_2_00007FF68A082894
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A091528 0_2_00007FF68A091528
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A0840D4 0_2_00007FF68A0840D4
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A0790D0 0_2_00007FF68A0790D0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08F120 0_2_00007FF68A08F120
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A079D3B 0_2_00007FF68A079D3B
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A07A56D 0_2_00007FF68A07A56D
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08843C 0_2_00007FF68A08843C
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A09A5E8 0_2_00007FF68A09A5E8
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08E60C 0_2_00007FF68A08E60C
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A081E70 0_2_00007FF68A081E70
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A082690 0_2_00007FF68A082690
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A0E6F0 3_2_70A0E6F0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A0A7B0 3_2_70A0A7B0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A6FFB0 3_2_70A6FFB0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A0F7C0 3_2_70A0F7C0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A3A0A0 3_2_70A3A0A0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A3D800 3_2_70A3D800
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A3E860 3_2_70A3E860
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A77190 3_2_70A77190
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A27110 3_2_70A27110
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A3B110 3_2_70A3B110
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A7D910 3_2_70A7D910
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A23940 3_2_70A23940
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A5E140 3_2_70A5E140
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A43950 3_2_70A43950
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A6E150 3_2_70A6E150
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A35AF0 3_2_70A35AF0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A0F220 3_2_70A0F220
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A38270 3_2_70A38270
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A36250 3_2_70A36250
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A013E0 3_2_70A013E0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A6C330 3_2_70A6C330
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A3D310 3_2_70A3D310
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A22360 3_2_70A22360
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A57370 3_2_70A57370
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A6BB70 3_2_70A6BB70
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A3EC80 3_2_70A3EC80
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A34C20 3_2_70A34C20
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A6CC15 3_2_70A6CC15
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A24DA0 3_2_70A24DA0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A265B0 3_2_70A265B0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A965E0 3_2_70A965E0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A7DDF0 3_2_70A7DDF0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A38DC0 3_2_70A38DC0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A6EDC0 3_2_70A6EDC0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A7E510 3_2_70A7E510
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A31570 3_2_70A31570
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A22540 3_2_70A22540
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A2BD40 3_2_70A2BD40
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A41D40 3_2_70A41D40
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A3B550 3_2_70A3B550
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A436D0 3_2_70A436D0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A07E20 3_2_70A07E20
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A31E30 3_2_70A31E30
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A6D630 3_2_70A6D630
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A29E70 3_2_70A29E70
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A18E40 3_2_70A18E40
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A56FE2 3_2_70A56FE2
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A3CF20 3_2_70A3CF20
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A36F00 3_2_70A36F00
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A40700 3_2_70A40700
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A26F70 3_2_70A26F70
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D344CB 3_2_00007FF8A7D344CB
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D368CA 3_2_00007FF8A7D368CA
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D34E53 3_2_00007FF8A7D34E53
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3144C 3_2_00007FF8A7D3144C
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7E5E5F0 3_2_00007FF8A7E5E5F0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7E725D0 3_2_00007FF8A7E725D0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3318E 3_2_00007FF8A7D3318E
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D36FFF 3_2_00007FF8A7D36FFF
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D365A0 3_2_00007FF8A7D365A0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D31A50 3_2_00007FF8A7D31A50
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D36EBF 3_2_00007FF8A7D36EBF
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D33634 3_2_00007FF8A7D33634
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D32171 3_2_00007FF8A7D32171
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D34F43 3_2_00007FF8A7D34F43
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D32301 3_2_00007FF8A7D32301
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3638E 3_2_00007FF8A7D3638E
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D326EE 3_2_00007FF8A7D326EE
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7EE6100 3_2_00007FF8A7EE6100
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7EEB0E0 3_2_00007FF8A7EEB0E0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D36D5C 3_2_00007FF8A7D36D5C
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D4F060 3_2_00007FF8A7D4F060
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7ED3010 3_2_00007FF8A7ED3010
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D4EF00 3_2_00007FF8A7D4EF00
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D353C6 3_2_00007FF8A7D353C6
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3213A 3_2_00007FF8A7D3213A
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D31217 3_2_00007FF8A7D31217
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D35434 3_2_00007FF8A7D35434
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D310AA 3_2_00007FF8A7D310AA
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7E12CD0 3_2_00007FF8A7E12CD0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D31299 3_2_00007FF8A7D31299
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D36564 3_2_00007FF8A7D36564
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D34408 3_2_00007FF8A7D34408
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D354CF 3_2_00007FF8A7D354CF
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D315C8 3_2_00007FF8A7D315C8
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D31B27 3_2_00007FF8A7D31B27
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7E72C00 3_2_00007FF8A7E72C00
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D33A94 3_2_00007FF8A7D33A94
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D34D09 3_2_00007FF8A7D34D09
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D35F10 3_2_00007FF8A7D35F10
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D35DA3 3_2_00007FF8A7D35DA3
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D323F6 3_2_00007FF8A7D323F6
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D353AD 3_2_00007FF8A7D353AD
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7EEA900 3_2_00007FF8A7EEA900
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7E67780 3_2_00007FF8A7E67780
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D9F700 3_2_00007FF8A7D9F700
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3435E 3_2_00007FF8A7D3435E
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D31B36 3_2_00007FF8A7D31B36
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3474B 3_2_00007FF8A7D3474B
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D35A65 3_2_00007FF8A7D35A65
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D5B550 3_2_00007FF8A7D5B550
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7E67480 3_2_00007FF8A7E67480
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D32671 3_2_00007FF8A7D32671
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D33BA7 3_2_00007FF8A7D33BA7
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D32987 3_2_00007FF8A7D32987
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D37257 3_2_00007FF8A7D37257
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D33837 3_2_00007FF8A7D33837
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D4F200 3_2_00007FF8A7D4F200
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D5B1C0 3_2_00007FF8A7D5B1C0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D36EF1 3_2_00007FF8A7D36EF1
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3114F 3_2_00007FF8A7D3114F
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D350B0 3_2_00007FF8A7D350B0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D34106 3_2_00007FF8A7D34106
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D4BF20 3_2_00007FF8A7D4BF20
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D360DC 3_2_00007FF8A7D360DC
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D35E25 3_2_00007FF8A7D35E25
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D32D10 3_2_00007FF8A7D32D10
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D4BD60 3_2_00007FF8A7D4BD60
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D31CC6 3_2_00007FF8A7D31CC6
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7E63CC0 3_2_00007FF8A7E63CC0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D33792 3_2_00007FF8A7D33792
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3707C 3_2_00007FF8A7D3707C
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3416A 3_2_00007FF8A7D3416A
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D357D6 3_2_00007FF8A7D357D6
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D33698 3_2_00007FF8A7D33698
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3348B 3_2_00007FF8A7D3348B
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D34B5B 3_2_00007FF8A7D34B5B
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D36C21 3_2_00007FF8A7D36C21
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D329D2 3_2_00007FF8A7D329D2
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7E6C660 3_2_00007FF8A7E6C660
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3177B 3_2_00007FF8A7D3177B
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D4C620 3_2_00007FF8A7D4C620
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D325F4 3_2_00007FF8A7D325F4
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D32144 3_2_00007FF8A7D32144
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D369E7 3_2_00007FF8A7D369E7
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D4C480 3_2_00007FF8A7D4C480
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D372C5 3_2_00007FF8A7D372C5
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7DE0440 3_2_00007FF8A7DE0440
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7F70E00 3_2_00007FF8A7F70E00
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D35B14 3_2_00007FF8A7D35B14
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D32C7A 3_2_00007FF8A7D32C7A
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7ED4170 3_2_00007FF8A7ED4170
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D35B78 3_2_00007FF8A7D35B78
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3710D 3_2_00007FF8A7D3710D
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7ED50B0 3_2_00007FF8A7ED50B0
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D36A87 3_2_00007FF8A7D36A87
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D3655F 3_2_00007FF8A7D3655F
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D33FDF 3_2_00007FF8A7D33FDF
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D31F9B 3_2_00007FF8A7D31F9B
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D322ED 3_2_00007FF8A7D322ED
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D360A0 3_2_00007FF8A7D360A0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FF8A7D32A09 appears 110 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FF8A7D32739 appears 347 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 70A04230 appears 238 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 70A2D400 appears 325 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FF8A7D3405C appears 502 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 70A96CA0 appears 192 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FF8A7D3698D appears 36 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FF8A7D324BE appears 48 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FF8A7D34840 appears 92 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FF68A072B20 appears 47 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 70A96730 appears 31 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FF8A7D31EF6 appears 1099 times
PE file does not import any functions
Source: python3.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: s.exe Binary or memory string: OriginalFilename vs s.exe
Source: s.exe, 00000003.00000002.3404703685.00007FF8B93D2000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3405259963.00007FF8BA527000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs s.exe
Source: s.exe, 00000003.00000002.3394136082.0000020D33860000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs s.exe
Source: s.exe, 00000003.00000002.3404140877.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3403097651.00007FF8B78C5000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3402861098.00007FF8B783E000.00000002.00000001.01000000.00000019.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3402065976.00007FF8B573A000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3400733315.00007FF8A8608000.00000002.00000001.01000000.00000013.sdmp Binary or memory string: OriginalFilenametcl86.dllP vs s.exe
Source: s.exe, 00000003.00000002.3403655719.00007FF8B825E000.00000002.00000001.01000000.00000012.sdmp Binary or memory string: OriginalFilename_tkinter.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3405048706.00007FF8B9F7D000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3401835210.00007FF8A8F28000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamepython310.dll. vs s.exe
Source: s.exe, 00000003.00000002.3402459653.00007FF8B621B000.00000002.00000001.01000000.00000018.sdmp Binary or memory string: OriginalFilenamelibsslH vs s.exe
Source: s.exe, 00000003.00000002.3403500419.00007FF8B810C000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs s.exe
Source: s.exe, 00000003.00000002.3403265477.00007FF8B800D000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilenamepyexpat.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3404536393.00007FF8B9104000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3399511734.00007FF8A8079000.00000002.00000001.01000000.00000017.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs s.exe
Source: s.exe, 00000003.00000002.3404310250.00007FF8B8F92000.00000002.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3404875417.00007FF8B9846000.00000002.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3401071726.00007FF8A8AD1000.00000002.00000001.01000000.0000001C.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs s.exe
Source: s.exe, 00000003.00000002.3400397930.00007FF8A8422000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: OriginalFilenametk86.dllP vs s.exe
Source: s.exe Static PE information: Section: .rsrc ZLIB complexity 0.9902775857300885
Source: classification engine Classification label: mal56.troj.evad.winEXE@6/1025@2/2
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A078570 GetLastError,FormatMessageW,WideCharToMultiByte, 0_2_00007FF68A078570
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_03
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI17722 Jump to behavior
Source: s.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\s.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: s.exe String found in binary or memory: -startline must be less than or equal to -endline
Source: s.exe String found in binary or memory: -help
Source: C:\Users\user\Desktop\s.exe File read: C:\Users\user\Desktop\s.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\s.exe "C:\Users\user\Desktop\s.exe"
Source: C:\Users\user\Desktop\s.exe Process created: C:\Users\user\Desktop\s.exe "C:\Users\user\Desktop\s.exe"
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\s.exe Process created: C:\Users\user\Desktop\s.exe "C:\Users\user\Desktop\s.exe" Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: libffi-7.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: tcl86t.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: tk86t.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\Desktop\pyvenv.cfg Jump to behavior
Source: s.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: s.exe Static file information: File size 15929368 > 1048576
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: s.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: class pdb.Pdb(completekey='tab', stdin=None, stdout=None, skip=None, nosigint=False, readrc=True) source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: s.exe, 00000003.00000002.3400842141.00007FF8A8ACC000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: Changed in version 3.2: ".pdbrc" can now contain commands that source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: s.exe, 00000003.00000002.3401939053.00007FF8B5729000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: s.exe, 00000003.00000002.3404422770.00007FF8B90FB000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: ucrtbase.pdb source: s.exe, 00000003.00000002.3403422407.00007FF8B80D1000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: s.exe, 00000003.00000002.3401939053.00007FF8B5729000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: Raises an auditing event "pdb.Pdb" with no arguments. source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: s.exe, 00000003.00000002.3402387778.00007FF8B61E6000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: commands as if given in a ".pdbrc" file, see Debugger Commands. source: topics.pyc.0.dr
Source: Binary string: If a file ".pdbrc" exists in the user source: topics.pyc.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: s.exe, 00000003.00000002.3399286880.00007FF8A7F80000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: ~/.pdbrc source: s.exe, 00000003.00000002.3396766134.0000020D36A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: import pdb; pdb.Pdb(skip=['django.*']).set_trace() source: topics.pyc.0.dr
Source: Binary string: placed in the .pdbrc file): source: s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pdb.Pdb source: s.exe, 00000003.00000002.3396766134.0000020D36A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: s.exe, 00000003.00000002.3403594861.00007FF8B8258000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: s.exe, 00000003.00000003.2306356375.0000020D35CD8000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395067334.0000020D35D5B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: will load .pdbrc files from the filesystem. source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: s.exe, 00000003.00000002.3399286880.00007FF8A8002000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc@B source: s.exe, 00000003.00000002.3396766134.0000020D36A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: s.exe, 00000003.00000002.3402387778.00007FF8B61E6000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: s.exe, 00000003.00000002.3404806293.00007FF8B9843000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: s.exe, 00000003.00000002.3399286880.00007FF8A7F80000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: s.exe, 00000003.00000003.2306356375.0000020D35CD8000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395067334.0000020D35D5B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: s.exe, 00000003.00000002.3405191896.00007FF8BA521000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: s.exe, 00000003.00000002.3404979801.00007FF8B9F70000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: s.exe, 00000003.00000002.3402793467.00007FF8B7836000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: .pdbrc source: s.exe, 00000003.00000002.3396766134.0000020D36A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: in the ".pdbrc" file): source: topics.pyc.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: s.exe, 00000003.00000002.3403199884.00007FF8B8002000.00000002.00000001.01000000.0000000F.sdmp, pyexpat.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: s.exe, 00000003.00000002.3401297091.00007FF8A8E1F000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: s.exe, 00000003.00000002.3404071756.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: s.exe, 00000003.00000002.3404422770.00007FF8B90FB000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: s.exe, 00000003.00000002.3404636449.00007FF8B93CD000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: ucrtbase.pdbUGP source: s.exe, 00000003.00000002.3403422407.00007FF8B80D1000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: s.exe, 00000003.00000002.3404243239.00007FF8B8F88000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: s.exe, 00000003.00000002.3394136082.0000020D33860000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: s.exe, 00000003.00000002.3395514478.0000020D3644C000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000003.00000002.3395514478.0000020D36263000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: s.exe, 00000003.00000002.3402959420.00007FF8B78AD000.00000002.00000001.01000000.00000016.sdmp
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext, 3_2_70A70C90
PE file contains sections with non-standard names
Source: s.exe Static PE information: section name: _RDATA
Source: python310.dll.0.dr Static PE information: section name: PyRuntim

Persistence and Installation Behavior
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\s.exe Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d 3_2_70A22B90
Source: C:\Users\user\Desktop\s.exe Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d 3_2_70A227E0
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\s.exe Process created: "C:\Users\user\Desktop\s.exe"
Drops PE files
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI17722\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI17722\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI17722\python310.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI17722\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI17722\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI17722\tk86t.dll Jump to dropped file

Boot Survival
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\s.exe Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d 3_2_70A22B90
Source: C:\Users\user\Desktop\s.exe Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d 3_2_70A227E0
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A0751F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00007FF68A0751F0
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI17722\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI17722\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI17722\python310.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI17722\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI17722\python3.dll Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\s.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\s.exe API coverage: 3.3 %
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\s.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08843C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF68A08843C
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A0924D4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF68A0924D4
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A078B00 FindFirstFileExW,FindClose, 0_2_00007FF68A078B00
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08843C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF68A08843C
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A06A70 GetSystemInfo,VirtualAlloc,VirtualAlloc, 3_2_70A06A70
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI17722\ Jump to behavior
Source: s.exe, 00000003.00000002.3394809453.0000020D35BB0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: C:\Users\user\Desktop\s.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\s.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08B1C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF68A08B1C8
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext, 3_2_70A70C90
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A0940E0 GetProcessHeap, 0_2_00007FF68A0940E0
Enables debug privileges
Source: C:\Users\user\Desktop\s.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A08B1C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF68A08B1C8
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A07C89C SetUnhandledExceptionFilter, 0_2_00007FF68A07C89C
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A07BE30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF68A07BE30
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A07C6BC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF68A07C6BC
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A95380 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort, 3_2_70A95380
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D35A24 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00007FF8A7D35A24
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\s.exe Process created: C:\Users\user\Desktop\s.exe "C:\Users\user\Desktop\s.exe" Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A09A430 cpuid 0_2_00007FF68A09A430
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes\client VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes\tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes\tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes\tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes\tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\comtypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\concurrent VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\concurrent\futures VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\concurrent VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\concurrent VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\concurrent\futures VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\macholib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\http VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\http VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\http VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\http VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\idna VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\idna VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\idna VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib\metadata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib\metadata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib\metadata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib\metadata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib\metadata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\json VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\json VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing\dummy VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\importlib_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\importlib_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\importlib_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\jaraco VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\jaraco VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\jaraco VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\more_itertools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\more_itertools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\pyparsing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\pyparsing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\pyparsing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\pyparsing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\pyparsing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\pyparsing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources\_vendor\pyparsing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\psutil VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\psutil VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\psutil VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\psutil VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pyautogui VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pyautogui VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pyautogui VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api\endpointvolume VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api\mmdeviceapi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api\mmdeviceapi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw\api\mmdeviceapi\depend VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pycaw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pydoc_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pygetwindow VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\pygetwindow VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\requests VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl8 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl8\8.4 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl8 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl8\8.5 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ucrtbase.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\Desktop\s.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\_ctypes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\_endian.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\_endian.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\_endian.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\ctypes\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\shutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\shutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\shutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\bz2.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\bz2.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\bz2.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\_compression.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\_compression.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\_compression.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\_bz2.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\lzma.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\lzma.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\lzma.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\_lzma.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\subprocess.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\subprocess.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\subprocess.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\signal.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\signal.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\signal.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\threading.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\threading.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\threading.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI17722\contextlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A07C5A0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF68A07C5A0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF68A096960 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 0_2_00007FF68A096960
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_70A70CFC GetVersion,GetCurrentThread, 3_2_70A70CFC
Source: C:\Users\user\Desktop\s.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\s.exe Code function: 3_2_00007FF8A7D32B62 bind,WSAGetLastError, 3_2_00007FF8A7D32B62
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1428469 Sample: s.exe Startdate: 19/04/2024 Architecture: WINDOWS Score: 56 29 api.telegram.org 2->29 31 ipinfo.io 2->31 9 s.exe 1001 2->9         started        signatures3 37 Uses the Telegram API (likely for C&C communication) 29->37 process4 file5 21 C:\Users\user\AppData\Local\...\tk86t.dll, PE32+ 9->21 dropped 23 C:\Users\user\AppData\Local\...\tcl86t.dll, PE32+ 9->23 dropped 25 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 9->25 dropped 27 4 other files (none is malicious) 9->27 dropped 39 Contains functionality to infect the boot sector 9->39 41 Found pyInstaller with non standard icon 9->41 13 s.exe 9->13         started        signatures6 process7 dnsIp8 33 api.telegram.org 149.154.167.220, 443, 49727 TELEGRAMRU United Kingdom 13->33 35 ipinfo.io 34.117.186.192, 443, 49726 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 13->35 43 Hides threads from debuggers 13->43 17 cmd.exe 1 13->17         started        signatures9 process10 process11 19 conhost.exe 17->19         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.186.192
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
ipinfo.io 34.117.186.192 true
api.telegram.org 149.154.167.220 true