Windows Analysis Report
Sp#U251c#U0434ti.exe

Overview

General Information

Sample name: Sp#U251c#U0434ti.exe
renamed because original name is a hash value
Original sample name: Spti.exe
Analysis ID: 1428521
MD5: 0ceaf63f222faad3bfa66b0bcbddca69
SHA1: d9eb66edd0a0657be291ef9c52390a6f5a12ddf5
SHA256: dbdf5ccea961db26a656fca73bcac131fe7a28fde408e4892a669c941c1376bf
Tags: exe
Infos:

Detection

DanaBot
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected DanaBot stealer dll
Contains functionality to infect the boot sector
Found pyInstaller with non standard icon
Hides threads from debuggers
Uses the Telegram API (likely for C&C communication)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
DanaBot Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.
  • SCULLY SPIDER
 https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Sp#U251c#U0434ti.exe Virustotal: Detection: 7% Perma Link
Yara detected DanaBot stealer dll
Source: Yara match File source: 00000002.00000003.2408604626.000001BBBEB51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A380F0 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext, 2_2_70A380F0
Source: Sp#U251c#U0434ti.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4060720861.00007FF8B61CC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4055131294.00007FF8A7D1C000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: Sp#U251c#U0434ti.exe, 00000002.00000002.4058618897.00007FF8B0559000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: ucrtbase.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062436600.00007FF8B80D1000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063905239.00007FF8B90FB000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4058618897.00007FF8B0559000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: .pdbrcO` source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: Sp#U251c#U0434ti.exe, 00000002.00000002.4057075647.00007FF8A8AA6000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063350800.00007FF8B8CB5000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: Sp#U251c#U0434ti.exe, 00000002.00000002.4060720861.00007FF8B61CC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: Sp#U251c#U0434ti.exe, 00000002.00000002.4056646945.00007FF8A8510000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: ~/.pdbrc source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063101715.00007FF8B8AF5000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: placed in the .pdbrc file): source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF201000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pdb.Pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4060299096.00007FF8B6048000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF1BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062019830.00007FF8B78B0000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF201000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4056646945.00007FF8A8592000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4057075647.00007FF8A8AA6000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064349266.00007FF8B9843000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: Sp#U251c#U0434ti.exe, 00000002.00000002.4056646945.00007FF8A8510000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064730035.00007FF8BA521000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF1BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064516661.00007FF8B9F70000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4059892046.00007FF8B6026000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: .pdbrc source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061617679.00007FF8B7833000.00000002.00000001.01000000.00000013.sdmp, win32api.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062619819.00007FF8B8257000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061617679.00007FF8B7833000.00000002.00000001.01000000.00000013.sdmp, win32api.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062224509.00007FF8B8002000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4057426355.00007FF8A8E1F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063561581.00007FF8B8F73000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063905239.00007FF8B90FB000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064181504.00007FF8B93CD000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062019830.00007FF8B78B0000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: ucrtbase.pdbUGP source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062436600.00007FF8B80D1000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063733225.00007FF8B8F88000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4049881385.000001BBBC6C0000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052619926.000001BBBFBB0000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061211082.00007FF8B77FD000.00000002.00000001.01000000.00000014.sdmp
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B55610 FindFirstFileExW, 0_2_00007FF720B55610
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B39250 FindFirstFileExW,FindClose, 0_2_00007FF720B39250
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B39250 FindFirstFileExW,FindClose, 2_2_00007FF720B39250
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B55610 FindFirstFileExW, 2_2_00007FF720B55610
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI9842\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI9842\tcl\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 4x nop then sub rsp, 58h 0_2_00007FF720B3DDF0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 4x nop then push rbx 0_2_00007FF720B3E196
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 4x nop then push rbp 2_2_70A2BD40
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 4x nop then push rbp 2_2_70A2BD40
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 4x nop then push rbx 2_2_00007FF720B3E196
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 4x nop then sub rsp, 58h 2_2_00007FF720B3DDF0

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
May check the online IP address of the machine
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown DNS traffic detected: queries for: ipinfo.io
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053790133.000001BBC0960000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.../back.jpeg
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052346971.000001BBBF990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://aka.ms/vcpython27
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2291267218.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://bugs.python.org/issue14443
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053507901.000001BBC04C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://bugs.python.org/issue23606)
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2364674642.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2364674642.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2282603222.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000000.00000003.2286272911.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2282603222.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000000.00000003.2286272911.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEAB0000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2408991201.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF1BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050210280.000001BBBE740000.00000004.00000020.00020000.00000000.sdmp, more.pyc.0.dr String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF0F7000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050210280.000001BBBE740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEBD5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlj
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crls
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crlts
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF0F7000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050210280.000001BBBE740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlrc
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2364674642.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2282603222.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000000.00000003.2286272911.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2282603222.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000000.00000003.2286272911.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2364674642.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2364674642.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2364674642.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053901887.000001BBC0A70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053339687.000001BBC0290000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052346971.000001BBBF990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052260874.000001BBBF890000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050808567.000001BBBEC40000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051996425.000001BBBF590000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: Sp#U251c#U0434ti.exe, 00000002.00000003.2408991201.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/unittest.html
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050895842.000001BBBED60000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/ActiveState/appdirs
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053790133.000001BBC0A4C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://goo.gl/zeJZl.
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2375451432.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBEFE1000.00000004.00000020.00020000.00000000.sdmp, connectionpool.pyc.0.dr String found in binary or memory: http://google.com/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEAB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2375451432.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052695743.000001BBBFC09000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053901887.000001BBC0A70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es0
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.esZ
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2282603222.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000000.00000003.2286272911.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2364674642.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2364674642.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2282603222.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000000.00000003.2286272911.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050808567.000001BBBEC40000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050417837.000001BBBE940000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: _sfc64.cp310-win_amd64.pyd.0.dr String found in binary or memory: http://pracrand.sourceforge.net/RNG_engines.txt
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052834567.000001BBBFCE6000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/6p
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/I
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/QI
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/TI
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/fpp5
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/mp
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051996425.000001BBBF590000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/questions/19622133/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tip.tcl.tk/48)
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050210280.000001BBBE740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050210280.000001BBBE740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es00
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050808567.000001BBBEC40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/TT
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/~K_5
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052429365.000001BBBFAAC000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF1BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: _sfc64.cp310-win_amd64.pyd.0.dr String found in binary or memory: http://www.pcg-random.org/posts/random-invertible-mapping-statistics.html
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEAB0000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE1F000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wwwsearch.sf.net/):
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0D04000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054324335.000001BBC1314000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/sendPhoto
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054324335.000001BBC1314000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/sendPhotoPI
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF21C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://blog.jaraco.com/skeleton
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051996425.000001BBBF590000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.python.org/issue44497.
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2194891669.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wiki
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://codecov.io/gh/pypa/setuptools
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2192306958.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000000.00000003.2192741998.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000000.00000003.2193451290.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/security/
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discord.com/channels/803025117553754132/815945031150993468
Source: Sp#U251c#U0434ti.exe, 00000002.00000003.2408604626.000001BBBEC0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEC0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBEFE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: Sp#U251c#U0434ti.exe, 00000002.00000003.2408604626.000001BBBEC0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEC0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBEFE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: Sp#U251c#U0434ti.exe, 00000002.00000003.2408604626.000001BBBEC0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050808567.000001BBBEC40000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052172362.000001BBBF790000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEC0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBEFE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051911764.000001BBBF490000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050328229.000001BBBE840000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2196060584.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, ImageFont.pyc.0.dr String found in binary or memory: https://dotcolon.net/font/aileron
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053790133.000001BBC0960000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052085116.000001BBBF690000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050808567.000001BBBEC40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052695743.000001BBBFC09000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4049592911.000001BBBC4AF000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2387009360.000001BBBDEDE000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2387078291.000001BBBDEDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2282603222.0000023D82DE5000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000000.00000003.2282603222.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2408991201.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2409545518.000001BBBF314000.00000004.00000020.00020000.00000000.sdmp, __init__.pyc62.0.dr String found in binary or memory: https://github.com/asweigart/pygetwindow
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053507901.000001BBC04C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053790133.000001BBC0A4C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050895842.000001BBBED60000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052085116.000001BBBF690000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061083435.00007FF8B6214000.00000002.00000001.01000000.00000012.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4061778307.00007FF8B7841000.00000002.00000001.01000000.00000013.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4062099534.00007FF8B78C1000.00000002.00000001.01000000.00000010.sdmp, win32api.pyd.0.dr String found in binary or memory: https://github.com/mhammond/pywin32
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/black
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr, binding.pyc.0.dr String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050985674.000001BBBEE70000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050808567.000001BBBEC40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packaging
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050985674.000001BBBEE70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packaging__cached__
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050808567.000001BBBEC40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packagingd
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/actions?query=workflow%3A%22tests%22
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/discussions
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/issues
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051996425.000001BBBF590000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050985674.000001BBBEE70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/workflows/tests/badge.svg
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050210280.000001BBBE740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053339687.000001BBC0290000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050042291.000001BBBE300000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2387009360.000001BBBDEDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: Sp#U251c#U0434ti.exe, 00000002.00000003.2387078291.000001BBBDEDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4049592911.000001BBBC4AF000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2387009360.000001BBBDEDE000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2387078291.000001BBBDEDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4049592911.000001BBBC4AF000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2387009360.000001BBBDEDE000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000003.2387078291.000001BBBDEDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: __init__.pyc29.0.dr String found in binary or memory: https://github.com/urllib3/urllib3/issues/2168
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053790133.000001BBC0960000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2375451432.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053790133.000001BBC0960000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: __init__.pyc29.0.dr String found in binary or memory: https://github.com/urllib3/urllib3/issues/3020
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBEF90000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEA40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBEF90000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF21C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEAB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEA40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052695743.000001BBBFC09000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052695743.000001BBBFC3B000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF21C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/get
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEAB0000.00000004.00000020.00020000.00000000.sdmp, __init__.pyc73.0.dr String found in binary or memory: https://httpbin.org/post
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://img.shields.io/badge/code%20style-black-000000.svg
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://img.shields.io/badge/skeleton-2022-informational
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://img.shields.io/discord/803025117553754132
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://img.shields.io/pypi/pyversions/setuptools.svg
Source: METADATA.0.dr String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://img.shields.io/pypi/v/setuptools.svg
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://img.shields.io/readthedocs/setuptools/latest.svg
Source: _legacy.pyc.0.dr String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054324335.000001BBC1300000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/json
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054324335.000001BBC1300000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/json27.39MB
Source: Sp#U251c#U0434ti.exe, 00000002.00000003.2409665236.000001BBBF31F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052695743.000001BBBFC09000.00000004.00000020.00020000.00000000.sdmp, request.pyc1.0.dr String found in binary or memory: https://mahler:8092/site-updates.py
Source: METADATA.0.dr String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mouseinfo.readthedocs.io
Source: _sfc64.cp310-win_amd64.pyd.0.dr String found in binary or memory: https://numpy.org/devdocs/user/troubleshooting-importerror.html#c-api-incompatibility
Source: Sp#U251c#U0434ti.exe, 00000002.00000003.2408991201.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/installing/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052085116.000001BBBF690000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050808567.000001BBBEC40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053507901.000001BBC04C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: METADATA.0.dr String found in binary or memory: https://pypi.org/project/cryptography/
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pypi.org/project/setuptools
Source: __init__.pyc6.0.dr String found in binary or memory: https://pypi.org/project/typing-extensions/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4057426355.00007FF8A8E1F000.00000002.00000001.01000000.00000005.sdmp String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/pypa/setuptools/main/docs/images/banner-640x320.svg
Source: METADATA.0.dr String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052085116.000001BBBF690000.00000004.00001000.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050808567.000001BBBEC40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEAB0000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053901887.000001BBC0A70000.00000004.00001000.00020000.00000000.sdmp, __init__.pyc73.0.dr String found in binary or memory: https://requests.readthedocs.io
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050210280.000001BBBE740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052085116.000001BBBF690000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/stable/history.html
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0D04000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/a/20982715/185510
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052172362.000001BBBF790000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/18905702/python-ctypes-and-mutable-buffers
Source: Sp#U251c#U0434ti.exe, 00000002.00000003.2408604626.000001BBBEC0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEC0C000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBEFE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053790133.000001BBC0A4C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052172362.000001BBBF790000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tidelift.com/badges/github/pypa/setuptools?style=flat
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tidelift.com/security
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=readme
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2289599566.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF21C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEA40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051996425.000001BBBF590000.00000004.00001000.00020000.00000000.sdmp, config.pyc.0.dr String found in binary or memory: https://upload.pypi.org/legacy/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053790133.000001BBC0960000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: connectionpool.pyc.0.dr String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2197253400.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEB9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2192741998.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2197253400.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEB9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20240227115053/https://exiv2.org/tags.html)
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4049592911.000001BBBC4AF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2195480364.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, ImageCms.pyc.0.dr String found in binary or memory: https://www.cazabon.com
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2195480364.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, ImageCms.pyc.0.dr String found in binary or memory: https://www.cazabon.com/pyCMS
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2364674642.0000023D82E0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2195480364.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, ImageCms.pyc.0.dr String found in binary or memory: https://www.littlecms.com
Source: Sp#U251c#U0434ti.exe, 00000000.00000003.2195972635.0000023D82DDA000.00000004.00000020.00020000.00000000.sdmp, ImageFilter.pyc.0.dr String found in binary or memory: https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdf
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4057142758.00007FF8A8ADB000.00000002.00000001.01000000.00000015.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4056871059.00007FF8A8609000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.openssl.org/H
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEAB0000.00000004.00000020.00020000.00000000.sdmp, __init__.pyc73.0.dr String found in binary or memory: https://www.python.org
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052695743.000001BBBFC09000.00000004.00000020.00020000.00000000.sdmp, request.pyc1.0.dr String found in binary or memory: https://www.python.org/
Source: Sp#U251c#U0434ti.exe, 00000002.00000003.2389143180.000001BBBE813000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4050417837.000001BBBE940000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050042291.000001BBBE300000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053053958.000001BBBFDC2000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052994203.000001BBBFD28000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4053096462.000001BBBFE3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBEF90000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726

E-Banking Fraud
barindex
Yara detected DanaBot stealer dll
Source: Yara match File source: 00000002.00000003.2408604626.000001BBBEB51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A97091: DeviceIoControl, 2_2_70A97091
Detected potential crypto function
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B37D20 0_2_00007FF720B37D20
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B3AA80 0_2_00007FF720B3AA80
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B3EA10 0_2_00007FF720B3EA10
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B3B258 0_2_00007FF720B3B258
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B3D0E0 0_2_00007FF720B3D0E0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B444B0 0_2_00007FF720B444B0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B324C0 0_2_00007FF720B324C0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B3B458 0_2_00007FF720B3B458
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B39880 0_2_00007FF720B39880
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B40C20 0_2_00007FF720B40C20
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B3B438 0_2_00007FF720B3B438
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A0E6F0 2_2_70A0E6F0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A0A7B0 2_2_70A0A7B0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A6FFB0 2_2_70A6FFB0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A0F7C0 2_2_70A0F7C0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A3A0A0 2_2_70A3A0A0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A3D800 2_2_70A3D800
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A3E860 2_2_70A3E860
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A77190 2_2_70A77190
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A27110 2_2_70A27110
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A3B110 2_2_70A3B110
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A7D910 2_2_70A7D910
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A23940 2_2_70A23940
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A5E140 2_2_70A5E140
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A43950 2_2_70A43950
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A6E150 2_2_70A6E150
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A35AF0 2_2_70A35AF0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A0F220 2_2_70A0F220
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A38270 2_2_70A38270
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A36250 2_2_70A36250
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A013E0 2_2_70A013E0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A6C330 2_2_70A6C330
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A3D310 2_2_70A3D310
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A22360 2_2_70A22360
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A57370 2_2_70A57370
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A6BB70 2_2_70A6BB70
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A3EC80 2_2_70A3EC80
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A34C20 2_2_70A34C20
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A6CC15 2_2_70A6CC15
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A24DA0 2_2_70A24DA0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A265B0 2_2_70A265B0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A965E0 2_2_70A965E0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A7DDF0 2_2_70A7DDF0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A38DC0 2_2_70A38DC0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A6EDC0 2_2_70A6EDC0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A7E510 2_2_70A7E510
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A31570 2_2_70A31570
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A22540 2_2_70A22540
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A2BD40 2_2_70A2BD40
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A41D40 2_2_70A41D40
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A3B550 2_2_70A3B550
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A436D0 2_2_70A436D0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A07E20 2_2_70A07E20
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A31E30 2_2_70A31E30
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A6D630 2_2_70A6D630
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A29E70 2_2_70A29E70
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A18E40 2_2_70A18E40
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A56FE2 2_2_70A56FE2
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A3CF20 2_2_70A3CF20
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A36F00 2_2_70A36F00
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A40700 2_2_70A40700
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A26F70 2_2_70A26F70
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B324C0 2_2_00007FF720B324C0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B3EA10 2_2_00007FF720B3EA10
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B3B258 2_2_00007FF720B3B258
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B3AA80 2_2_00007FF720B3AA80
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B444B0 2_2_00007FF720B444B0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B3B458 2_2_00007FF720B3B458
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B40C20 2_2_00007FF720B40C20
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B3B438 2_2_00007FF720B3B438
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B37D20 2_2_00007FF720B37D20
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B3D0E0 2_2_00007FF720B3D0E0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B39880 2_2_00007FF720B39880
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7C11860 2_2_00007FF8A7C11860
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A8026270 2_2_00007FF8A8026270
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7F710FE 2_2_00007FF8A7F710FE
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A8001930 2_2_00007FF8A8001930
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A8012980 2_2_00007FF8A8012980
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A80471B0 2_2_00007FF8A80471B0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A80BB1D0 2_2_00007FF8A80BB1D0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7F911D0 2_2_00007FF8A7F911D0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: String function: 70A04230 appears 238 times
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: String function: 70A2D400 appears 325 times
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: String function: 00007FF8A8068BD0 appears 138 times
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: String function: 70A96CA0 appears 192 times
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: String function: 00007FF720B32C10 appears 100 times
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: String function: 70A96730 appears 31 times
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: String function: 00007FF720B32CF0 appears 178 times
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: String function: 00007FF720B32D90 appears 32 times
PE file contains executable resources (Code or Archives)
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file contains more sections than normal
Source: Sp#U251c#U0434ti.exe Static PE information: Number of sections : 11 > 10
PE file does not import any functions
Source: python3.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: Sp#U251c#U0434ti.exe Binary or memory string: OriginalFilename vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4057142758.00007FF8A8ADB000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: OriginalFilenamelibsslH vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063800245.00007FF8B8F92000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062517197.00007FF8B810C000.00000002.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062685766.00007FF8B825E000.00000002.00000001.01000000.00000017.sdmp Binary or memory string: OriginalFilename_asyncio.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064076561.00007FF8B9104000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062289498.00007FF8B800D000.00000002.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilenamepyexpat.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4058371903.00007FF8A8F28000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamepython310.dll. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4055332933.00007FF8A7D21000.00000002.00000001.01000000.00000021.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061447753.00007FF8B7815000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4058934611.00007FF8B056A000.00000002.00000001.01000000.00000023.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4049881385.000001BBBC6C0000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061083435.00007FF8B6214000.00000002.00000001.01000000.00000012.sdmp Binary or memory string: OriginalFilenamepythoncom310.dll0 vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063627925.00007FF8B8F76000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061778307.00007FF8B7841000.00000002.00000001.01000000.00000013.sdmp Binary or memory string: OriginalFilenamewin32api.pyd0 vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4056871059.00007FF8A8609000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063178738.00007FF8B8AFA000.00000002.00000001.01000000.00000018.sdmp Binary or memory string: OriginalFilename_overlapped.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4060057880.00007FF8B602E000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064801225.00007FF8BA527000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4056243890.00007FF8A8292000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: OriginalFilenametk86.dllP vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064249011.00007FF8B93D2000.00000002.00000001.01000000.0000000A.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4060460070.00007FF8B604E000.00000002.00000001.01000000.0000001A.sdmp Binary or memory string: OriginalFilename_tkinter.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063451222.00007FF8B8CB9000.00000002.00000001.01000000.00000011.sdmp Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064414196.00007FF8B9846000.00000002.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062099534.00007FF8B78C1000.00000002.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilenamepywintypes310.dll0 vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4055988472.00007FF8A8128000.00000002.00000001.01000000.0000001C.sdmp Binary or memory string: OriginalFilenametcl86.dllP vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064590597.00007FF8B9F7D000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs Sp#U251c#U0434ti.exe
Source: Sp#U251c#U0434ti.exe Static PE information: Section: .rsrc ZLIB complexity 0.9902948700221239
Source: classification engine Classification label: mal72.troj.evad.winEXE@11/1025@2/2
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B38BB0 FormatMessageW,WideCharToMultiByte,GetLastError, 0_2_00007FF720B38BB0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1276:120:WilError_03
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842 Jump to behavior
Source: Sp#U251c#U0434ti.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Sp#U251c#U0434ti.exe Virustotal: Detection: 7%
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File read: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe "C:\Users\user\Desktop\Sp#U251c#U0434ti.exe"
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe "C:\Users\user\Desktop\Sp#U251c#U0434ti.exe"
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe "C:\Users\user\Desktop\Sp#U251c#U0434ti.exe" Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: libffi-7.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: tcl86t.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: tk86t.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\Desktop\pyvenv.cfg Jump to behavior
Source: Sp#U251c#U0434ti.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: Sp#U251c#U0434ti.exe Static file information: File size 37180338 > 1048576
Source: Sp#U251c#U0434ti.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4060720861.00007FF8B61CC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4055131294.00007FF8A7D1C000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: Sp#U251c#U0434ti.exe, 00000002.00000002.4058618897.00007FF8B0559000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: ucrtbase.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062436600.00007FF8B80D1000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063905239.00007FF8B90FB000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4058618897.00007FF8B0559000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: .pdbrcO` source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: Sp#U251c#U0434ti.exe, 00000002.00000002.4057075647.00007FF8A8AA6000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063350800.00007FF8B8CB5000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: Sp#U251c#U0434ti.exe, 00000002.00000002.4060720861.00007FF8B61CC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: Sp#U251c#U0434ti.exe, 00000002.00000002.4056646945.00007FF8A8510000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: ~/.pdbrc source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063101715.00007FF8B8AF5000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: placed in the .pdbrc file): source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF201000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF29D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pdb.Pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4060299096.00007FF8B6048000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF1BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062019830.00007FF8B78B0000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF201000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4056646945.00007FF8A8592000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4057075647.00007FF8A8AA6000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064349266.00007FF8B9843000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: Sp#U251c#U0434ti.exe, 00000002.00000002.4056646945.00007FF8A8510000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064730035.00007FF8BA521000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: Sp#U251c#U0434ti.exe, 00000002.00000002.4051136310.000001BBBF1BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064516661.00007FF8B9F70000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4059892046.00007FF8B6026000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: .pdbrc source: Sp#U251c#U0434ti.exe, 00000002.00000002.4053623011.000001BBC0710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061617679.00007FF8B7833000.00000002.00000001.01000000.00000013.sdmp, win32api.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062619819.00007FF8B8257000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061617679.00007FF8B7833000.00000002.00000001.01000000.00000013.sdmp, win32api.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062224509.00007FF8B8002000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4057426355.00007FF8A8E1F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063561581.00007FF8B8F73000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063905239.00007FF8B90FB000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4064181504.00007FF8B93CD000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062019830.00007FF8B78B0000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: ucrtbase.pdbUGP source: Sp#U251c#U0434ti.exe, 00000002.00000002.4062436600.00007FF8B80D1000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4063733225.00007FF8B8F88000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4049881385.000001BBBC6C0000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: Sp#U251c#U0434ti.exe, 00000002.00000002.4052619926.000001BBBFBB0000.00000004.00000020.00020000.00000000.sdmp, Sp#U251c#U0434ti.exe, 00000002.00000002.4052513393.000001BBBFB17000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: Sp#U251c#U0434ti.exe, 00000002.00000002.4061211082.00007FF8B77FD000.00000002.00000001.01000000.00000014.sdmp
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext, 2_2_70A70C90
PE file contains sections with non-standard names
Source: Sp#U251c#U0434ti.exe Static PE information: section name: .xdata
Source: python310.dll.0.dr Static PE information: section name: PyRuntim
Source: mfc140u.dll.0.dr Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: _RDATA
Source: _imagingft.cp310-win_amd64.pyd.0.dr Static PE information: section name: _RDATA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B4DFA0 push rsi; retf 0_2_00007FF720B4DFA1
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B4DFA0 push rsi; retf 2_2_00007FF720B4DFA1
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7D34AEE push 6FFDC5D5h; iretd 2_2_00007FF8A7D34AF4
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7D376D3 push 6FFDC5D5h; iretd 2_2_00007FF8A7D376D9
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7D34640 push 60F5C5F1h; iretd 2_2_00007FF8A7D34648
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7D37425 push 60F5C5F1h; iretd 2_2_00007FF8A7D3742D
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7D34FEA push 6FFDC5C3h; iretd 2_2_00007FF8A7D34FF0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7D379CF push 6FFDC5C3h; iretd 2_2_00007FF8A7D379D5
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7D34F9E push 6FFDC5CAh; ret 2_2_00007FF8A7D34FA4
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7D37983 push 6FFDC5CAh; ret 2_2_00007FF8A7D37989

Persistence and Installation Behavior
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d 2_2_70A22B90
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d 2_2_70A227E0
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: "C:\Users\user\Desktop\Sp#U251c#U0434ti.exe"
Drops PE files
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_bounded_integers.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_generator.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\bit_generator.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_webp.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\pywin32_system32\pythoncom310.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_mt19937.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\python310.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\Pythonwin\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_common.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\win32\win32pdh.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imaging.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imagingcms.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imagingft.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\win32com\shell\shell.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\yaml\_yaml.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\_cffi_backend.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\mtrand.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\VCRUNTIME140.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\charset_normalizer\md__mypyc.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\charset_normalizer\md.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_pcg64.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_sfc64.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\VCRUNTIME140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_philox.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imagingtk.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\pywin32_system32\pywintypes310.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\linalg\_umath_linalg.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imagingmath.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File created: C:\Users\user\AppData\Local\Temp\_MEI9842\Pythonwin\win32ui.pyd Jump to dropped file

Boot Survival
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d 2_2_70A22B90
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d 2_2_70A227E0
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B35780 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00007FF720B35780
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_bounded_integers.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_generator.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\bit_generator.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_webp.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\pywin32_system32\pythoncom310.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_mt19937.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\python310.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Pythonwin\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_common.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\win32\win32pdh.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imaging.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imagingcms.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imagingft.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\win32com\shell\shell.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\yaml\_yaml.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_cffi_backend.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\mtrand.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\charset_normalizer\md__mypyc.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\charset_normalizer\md.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_pcg64.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_sfc64.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\random\_philox.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imagingtk.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\pywin32_system32\pywintypes310.dll Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\numpy\linalg\_umath_linalg.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\PIL\_imagingmath.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Pythonwin\win32ui.pyd Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe API coverage: 4.8 %
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B55610 FindFirstFileExW, 0_2_00007FF720B55610
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B39250 FindFirstFileExW,FindClose, 0_2_00007FF720B39250
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B39250 FindFirstFileExW,FindClose, 2_2_00007FF720B39250
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B55610 FindFirstFileExW, 2_2_00007FF720B55610
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A06A70 GetSystemInfo,VirtualAlloc,VirtualAlloc, 2_2_70A06A70
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI9842\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI9842\tcl\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0DAC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vboxtray
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0DAC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vboxservice
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0DAC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: qemu-ga
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4050504142.000001BBBEA40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW|
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0DAC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwareuser
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0DAC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmusrvc
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0DAC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmsrvc
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0DAC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmtoolsd
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0DAC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwaretray
Source: Sp#U251c#U0434ti.exe, 00000002.00000002.4054126894.000001BBC0DAC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwareservice
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A70C60 IsDebuggerPresent,IsDebuggerPresent, 2_2_70A70C60
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext, 2_2_70A70C90
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A22A90 GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,HeapFree,GetNetworkParams,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree, 2_2_70A22A90
Enables debug privileges
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B31180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,wcslen,malloc,memcpy,_initterm, 0_2_00007FF720B31180
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 0_2_00007FF720B556C8 SetUnhandledExceptionFilter,WideCharToMultiByte, 0_2_00007FF720B556C8
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A95380 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort, 2_2_70A95380
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B31180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,wcslen,malloc,memcpy,_initterm, 2_2_00007FF720B31180
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF720B556C8 SetUnhandledExceptionFilter,WideCharToMultiByte, 2_2_00007FF720B556C8
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7C13028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF8A7C13028
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7C12A60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF8A7C12A60
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe "C:\Users\user\Desktop\Sp#U251c#U0434ti.exe" Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_00007FF8A7D31000 cpuid 2_2_00007FF8A7D31000
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_ctypes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes\_endian.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes\_endian.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes\_endian.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ctypes\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\shutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\shutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\shutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\bz2.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\bz2.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\bz2.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_compression.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_compression.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_compression.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_bz2.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\lzma.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\lzma.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\lzma.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_lzma.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\subprocess.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\subprocess.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\subprocess.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\signal.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\signal.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\signal.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\threading.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\threading.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\threading.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\contextlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\contextlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\contextlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-console-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-datetime-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-debug-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-errorhandling-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-file-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-file-l1-2-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-file-l2-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-heap-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-localization-l1-2-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-memory-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-namedpipe-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-processenvironment-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-profile-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-string-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-core-synch-l1-2-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-crt-convert-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-crt-filesystem-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-crt-process-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-crt-runtime-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\api-ms-win-crt-string-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ast.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\asyncio VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base64.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\bdb.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\bisect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\calendar.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\cgi.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\code.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\codeop.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\colorsys.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\csv.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\difflib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\doctest.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\getpass.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\libssl-1_1.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\opcode.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\packaging VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\platform.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\plugs.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pprint.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pyrect VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pyscreeze VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\python310.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pythoncom.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\py_compile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\stringprep.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\token.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\inspect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\inspect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\inspect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ast.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ast.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\ast.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\dis.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\dis.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\dis.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\opcode.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\opcode.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\opcode.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\machinery.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\machinery.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\machinery.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\tokenize.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\tokenize.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\tokenize.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\token.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\token.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\token.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pathlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pathlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pathlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\urllib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\urllib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\urllib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\urllib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\urllib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\urllib\parse.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\urllib\parse.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\urllib\parse.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkgutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkgutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkgutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\_abc.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\_abc.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\importlib\_abc.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_pyi_rth_utils\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_pyi_rth_utils\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_pyi_rth_utils\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\context.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\context.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\context.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\process.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\process.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\process.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\reduction.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\reduction.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\reduction.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_compat_pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_compat_pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_compat_pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\socket.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\socket.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\socket.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\_socket.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\selectors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\selectors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\selectors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\select.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\spawn.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\spawn.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\spawn.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\runpy.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\runpy.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\runpy.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\popen_spawn_win32.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\popen_spawn_win32.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\multiprocessing\popen_spawn_win32.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\tk VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkg_resources\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkg_resources\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkg_resources\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\zipfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\zipfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\zipfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\platform.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\platform.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\platform.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\plistlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\plistlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\plistlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\datetime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\datetime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\datetime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\parsers\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\parsers\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\parsers\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\parsers VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\parsers VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\parsers VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\parsers\expat.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\parsers\expat.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\xml\parsers\expat.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pyexpat.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\parser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\parser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\parser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\feedparser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\feedparser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\feedparser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\errors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\errors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\errors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\_policybase.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\_policybase.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\_policybase.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\header.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\header.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\header.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\quoprimime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\quoprimime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\quoprimime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\string.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\string.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\string.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\base64mime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\base64mime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\base64mime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base64.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base64.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base64.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\charset.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\charset.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\charset.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\encoders.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\encoders.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\encoders.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\quopri.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\quopri.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\quopri.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\utils.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\utils.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\utils.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\random.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\random.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\random.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\bisect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\bisect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\bisect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\_parseaddr.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\_parseaddr.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\email\_parseaddr.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\calendar.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\calendar.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\calendar.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\tempfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\tempfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\tempfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\textwrap.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\textwrap.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\textwrap.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI9842\pkg_resources\extern\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A952A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 2_2_70A952A0
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Code function: 2_2_70A70CFC GetVersion,GetCurrentThread, 2_2_70A70CFC
Source: C:\Users\user\Desktop\Sp#U251c#U0434ti.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected DanaBot stealer dll
Source: Yara match File source: 00000002.00000003.2408604626.000001BBBEB51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected DanaBot stealer dll
Source: Yara match File source: 00000002.00000003.2408604626.000001BBBEB51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1428521 Sample: Sp#U251c#U0434ti.exe Startdate: 19/04/2024 Architecture: WINDOWS Score: 72 35 api.telegram.org 2->35 37 ipinfo.io 2->37 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected DanaBot stealer dll 2->45 9 Sp#U251c#U0434ti.exe 1170 2->9         started        signatures3 47 Uses the Telegram API (likely for C&C communication) 35->47 process4 file5 27 C:\Users\user\...\_yaml.cp310-win_amd64.pyd, PE32+ 9->27 dropped 29 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 9->29 dropped 31 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 9->31 dropped 33 38 other files (none is malicious) 9->33 dropped 49 Contains functionality to infect the boot sector 9->49 51 Found pyInstaller with non standard icon 9->51 13 Sp#U251c#U0434ti.exe 9->13         started        signatures6 process7 dnsIp8 39 api.telegram.org 149.154.167.220, 443, 49727 TELEGRAMRU United Kingdom 13->39 41 ipinfo.io 34.117.186.192, 443, 49726 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 13->41 53 Hides threads from debuggers 13->53 17 cmd.exe 1 13->17         started        19 cmd.exe 1 13->19         started        signatures9 process10 process11 21 WMIC.exe 1 17->21         started        23 conhost.exe 17->23         started        25 conhost.exe 19->25         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.186.192
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false

Contacted Domains

Name IP Active
ipinfo.io 34.117.186.192 true
api.telegram.org 149.154.167.220 true