Windows Analysis Report
s.exe

Overview

General Information

Sample name: s.exe
Analysis ID: 1428702
MD5: 3f3772337a3b73822f085dbb0cd01900
SHA1: 7f1bfc5f2d474c4156311d1ba45b2e210af9379b
SHA256: 5deef62742a512f4b374349242938078be3f5158e37973cf731d8423c5c48f0c
Tags: exe
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Contains functionality to infect the boot sector
Found pyInstaller with non standard icon
Hides threads from debuggers
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Uses the Telegram API (likely for C&C communication)
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A380F0 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext, 4_2_70A380F0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B474 CryptReleaseContext, 4_2_70B2B474
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B46C CryptGenRandom, 4_2_70B2B46C
Source: s.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: s.exe, 00000004.00000002.2754574487.00007FFBAADBC000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: s.exe, 00000004.00000002.2747877494.00007FFBA9E79000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: ucrtbase.pdb source: s.exe, 00000004.00000002.2756457718.00007FFBABB01000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: s.exe, 00000004.00000002.2756812573.00007FFBB189B000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: s.exe, 00000004.00000002.2747877494.00007FFBA9E79000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: .pdbrcO` source: s.exe, 00000004.00000002.2739819511.000001E3BA970000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: s.exe, 00000004.00000002.2759416244.00007FFBBC705000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: ~/.pdbrc source: s.exe, 00000004.00000002.2739819511.000001E3BA970000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: placed in the .pdbrc file): source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: s.exe, 00000004.00000002.2757039470.00007FFBB4C48000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: pdb.Pdb source: s.exe, 00000004.00000002.2739819511.000001E3BA970000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: s.exe, 00000004.00000002.2754945356.00007FFBAAE20000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: s.exe, 00000004.00000002.2750653622.00007FFBAA2D0000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: s.exe, 00000004.00000002.2759829624.00007FFBBCA21000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: s.exe, 00000004.00000002.2758408188.00007FFBB62A0000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: s.exe, 00000004.00000002.2756209342.00007FFBABA36000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: s.exe, 00000004.00000002.2754307372.00007FFBAAD43000.00000002.00000001.01000000.00000014.sdmp, win32api.pyd.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: s.exe, 00000004.00000002.2756014940.00007FFBAB952000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: s.exe, 00000004.00000002.2754307372.00007FFBAAD43000.00000002.00000001.01000000.00000014.sdmp, win32api.pyd.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: s.exe, 00000004.00000002.2756812573.00007FFBB189B000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: s.exe, 00000004.00000002.2757999183.00007FFBB5CCD000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: win32trace.pyd.0.dr
Source: Binary string: ucrtbase.pdbUGP source: s.exe, 00000004.00000002.2756457718.00007FFBABB01000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: s.exe, 00000004.00000002.2757607453.00007FFBB5C18000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2748429315.00007FFBA9FBC000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: s.exe, 00000004.00000002.2749640819.00007FFBAA046000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: s.exe, 00000004.00000002.2754574487.00007FFBAADBC000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: s.exe, 00000004.00000002.2750653622.00007FFBAA2D0000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdbGCTL source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: -c are executed after commands from .pdbrc files. source: s.exe, 00000004.00000003.1614344119.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: s.exe, 00000004.00000002.2750653622.00007FFBAA352000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: s.exe, 00000004.00000002.2749640819.00007FFBAA046000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: s.exe, 00000004.00000002.2760013090.00007FFBBCD53000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: s.exe, 00000004.00000003.1614344119.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc source: s.exe, 00000004.00000002.2739819511.000001E3BA970000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: s.exe, 00000004.00000002.2759060026.00007FFBBBE92000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: s.exe, 00000004.00000002.2755273838.00007FFBAB17F000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: s.exe, 00000004.00000002.2759613310.00007FFBBCA03000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: s.exe, 00000004.00000002.2754945356.00007FFBAAE20000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: s.exe, 00000004.00000002.2736902585.000001E3B8EF0000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: s.exe, 00000004.00000003.1614344119.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: s.exe, 00000004.00000002.2753890539.00007FFBAAD0D000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A928C20 FindFirstFileExW,FindClose, 0_2_00007FF78A928C20
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E92E70 memset,PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,SetErrorMode,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,strcat_s,SetLastError,strcat_s,strcat_s,strcat_s,FindFirstVolumeMountPointA,strcpy_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,FindNextVolumeMountPointA,FindVolumeMountPointClose,strcat_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,strchr,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,_Py_Dealloc,_Py_Dealloc, 4_2_00007FFBA9E92E70
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI52802\tcl\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI52802\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\s.exe Code function: 4x nop then push rbp 4_2_70A2BD40
Source: C:\Users\user\Desktop\s.exe Code function: 4x nop then push rbp 4_2_70A2BD40

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
May check the online IP address of the machine
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown DNS traffic detected: queries for: ipinfo.io
Source: s.exe, 00000004.00000002.2739928267.000001E3BAA70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.../back.jpeg
Source: s.exe, 00000000.00000003.1478722709.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000000.00000003.1478159037.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000000.00000003.1477374589.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000000.00000003.1477049478.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739357951.000001E3BA546000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737304447.000001E3B97E0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: s.exe, 00000000.00000003.1573138762.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: s.exe, 00000000.00000003.1573138762.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: s.exe, 00000004.00000003.1614344119.000001E3B9B6E000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9BE3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: s.exe, 00000004.00000002.2737304447.000001E3B97E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: s.exe, 00000004.00000002.2741154458.000001E3BB450000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2736496223.000001E3B7560000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: s.exe, 00000004.00000002.2738625706.000001E3BA3A6000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: s.exe, 00000004.00000002.2741154458.000001E3BB450000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2736496223.000001E3B7560000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: s.exe, 00000004.00000002.2738625706.000001E3BA3A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crlex
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: s.exe, 00000004.00000002.2738625706.000001E3BA3A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0G
Source: s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crlE
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlY
Source: s.exe, 00000000.00000003.1573138762.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: s.exe, 00000000.00000003.1573138762.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: s.exe, 00000000.00000003.1573138762.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: s.exe, 00000000.00000003.1573138762.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: s.exe, 00000000.00000003.1477374589.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737304447.000001E3B97E0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: s.exe, 00000000.00000003.1477049478.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: s.exe, 00000000.00000003.1478159037.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739357951.000001E3BA546000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: s.exe, 00000000.00000003.1478560947.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000000.00000003.1476966750.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000000.00000003.1477628174.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000000.00000003.1477189886.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000000.00000003.1477268307.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB171000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740022516.000001E3BAB80000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000004.00000002.2741268059.000001E3BB940000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737680760.000001E3B9AE0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740115692.000001E3BAC90000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740350007.000001E3BAF60000.00000004.00001000.00020000.00000000.sdmp, _mode_ofb.pyc.0.dr, _mode_ctr.pyc.0.dr String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: s.exe, 00000004.00000002.2740115692.000001E3BAC90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: s.exe, 00000004.00000002.2738117362.000001E3B9CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/unittest.html
Source: s.exe, 00000004.00000002.2738222444.000001E3B9DF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/ActiveState/appdirs
Source: s.exe, 00000004.00000002.2740350007.000001E3BAF10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://goo.gl/zeJZl.
Source: s.exe, 00000000.00000003.1581690829.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, connectionpool.pyc.0.dr String found in binary or memory: http://google.com/
Source: s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: s.exe, 00000004.00000002.2738625706.000001E3BA3A6000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: s.exe, 00000004.00000002.2740115692.000001E3BAD58000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es
Source: s.exe, 00000004.00000002.2740999674.000001E3BB316000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es0
Source: s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es2
Source: s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es8
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: s.exe, 00000000.00000003.1573138762.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: s.exe, 00000000.00000003.1573138762.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: s.exe, 00000004.00000002.2738117362.000001E3B9CE0000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737579103.000001E3B99E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1F4000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB1D4000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740858038.000001E3BB236000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/
Source: s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/5
Source: s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/6)=C
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/d
Source: s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/j
Source: s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/l
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/rOfVideo
Source: s.exe, 00000004.00000002.2740476062.000001E3BB030000.00000004.00001000.00020000.00000000.sdmp, wmi.pyc.0.dr String found in binary or memory: http://timgolden.me.uk/python/wmi.html
Source: s.exe, 00000004.00000002.2740476062.000001E3BB030000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://timgolden.me.uk/python/wmi.htmlhed__
Source: s.exe, 00000004.00000003.1614344119.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, ttk.pyc.0.dr String found in binary or memory: http://tip.tcl.tk/48)
Source: s.exe, 00000000.00000003.1478619567.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB20000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740115692.000001E3BAC90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: s.exe, 00000004.00000002.2740022516.000001E3BAB80000.00000004.00001000.00020000.00000000.sdmp, ssl_match_hostname.pyc.0.dr String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: s.exe, 00000000.00000003.1478329852.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: s.exe, 00000004.00000002.2740999674.000001E3BB316000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: s.exe, 00000004.00000002.2740999674.000001E3BB316000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: s.exe, 00000004.00000002.2740999674.000001E3BB316000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: s.exe, 00000004.00000002.2740858038.000001E3BB236000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: s.exe, 00000004.00000002.2740999674.000001E3BB316000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: s.exe, 00000004.00000002.2740999674.000001E3BB316000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740858038.000001E3BB236000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es00
Source: s.exe, 00000004.00000002.2738117362.000001E3B9CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: s.exe, 00000004.00000002.2741154458.000001E3BB450000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: s.exe, 00000004.00000002.2741154458.000001E3BB450000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/.
Source: datetime.pyc.0.dr String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: s.exe, 00000000.00000003.1478722709.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740904440.000001E3BB2B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: datetime.pyc.0.dr String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: expatreader.pyc.0.dr String found in binary or memory: http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml
Source: s.exe, 00000004.00000002.2740476062.000001E3BB030000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9BAF000.00000004.00000020.00020000.00000000.sdmp, wmi.pyc.0.dr String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: wmi.pyc.0.dr String found in binary or memory: http://www.opensource.org/licenses/mit-license.phpFN
Source: datetime.pyc.0.dr String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: s.exe, 00000004.00000002.2740999674.000001E3BB316000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA201000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps
Source: s.exe, 00000004.00000002.2740999674.000001E3BB316000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB1D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: s.exe, 00000004.00000002.2738625706.000001E3BA201000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cpso
Source: s.exe, 00000000.00000003.1478329852.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wwwsearch.sf.net/):
Source: s.exe, 00000000.00000002.2735626974.000001BAE3A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: s.exe, 00000004.00000002.2741268059.000001E3BB940000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/
Source: s.exe, 00000004.00000002.2741394413.000001E3BBBC4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/sendPhoto
Source: s.exe, 00000004.00000002.2741394413.000001E3BBBC4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7058619531:AAFjAlypCbzRcRc65gGCD1WGy2bRSVD0Yh4/sendPhotoPI
Source: s.exe, 00000004.00000002.2737304447.000001E3B97E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module
Source: pyopenssl.pyc.0.dr String found in binary or memory: https://cryptography.io
Source: s.exe, 00000004.00000002.2738625706.000001E3BA150000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: s.exe, 00000004.00000002.2738625706.000001E3BA150000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: s.exe, 00000004.00000002.2737680760.000001E3B9AE0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA150000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738117362.000001E3B9CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html
Source: s.exe, 00000004.00000002.2737477660.000001E3B98E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: s.exe, 00000004.00000002.2739426839.000001E3BA550000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: s.exe, 00000004.00000002.2738117362.000001E3B9CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, __init__.pyc2.0.dr String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: s.exe, 00000004.00000002.2736496223.000001E3B7560000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000003.1591429597.000001E3B8F79000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000003.1591503533.000001E3B8F74000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: s.exe, 00000004.00000002.2739819511.000001E3BA970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: s.exe, 00000004.00000002.2740350007.000001E3BAF10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: s.exe, 00000004.00000002.2738222444.000001E3B9DF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: pyopenssl.pyc.0.dr String found in binary or memory: https://github.com/kjd/idna
Source: s.exe, 00000004.00000002.2754408569.00007FFBAAD51000.00000002.00000001.01000000.00000014.sdmp, s.exe, 00000004.00000002.2755028424.00007FFBAAE31000.00000002.00000001.01000000.00000011.sdmp, s.exe, 00000004.00000002.2754808046.00007FFBAAE04000.00000002.00000001.01000000.00000013.sdmp, win32api.pyd.0.dr, win32trace.pyd.0.dr String found in binary or memory: https://github.com/mhammond/pywin32
Source: s.exe, 00000004.00000002.2738324557.000001E3B9F00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packaging
Source: s.exe, 00000004.00000002.2738324557.000001E3B9F00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packaging__cached__
Source: s.exe, 00000004.00000002.2737680760.000001E3B9AE0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA150000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: s.exe, 00000004.00000002.2738222444.000001E3B9DF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: s.exe, 00000004.00000002.2737104022.000001E3B93A0000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000004.00000003.1591429597.000001E3B8F79000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000003.1591503533.000001E3B8F74000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: s.exe, 00000004.00000003.1591503533.000001E3B8F74000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: s.exe, 00000004.00000002.2736496223.000001E3B7560000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000003.1591429597.000001E3B8F79000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000003.1591503533.000001E3B8F74000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: s.exe, 00000004.00000002.2736496223.000001E3B7560000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000003.1591429597.000001E3B8F79000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000003.1591503533.000001E3B8F74000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: s.exe, 00000004.00000002.2738625706.000001E3BA39C000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2168
Source: s.exe, 00000004.00000002.2739426839.000001E3BA550000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: s.exe, 00000004.00000002.2738625706.000001E3BA1CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: s.exe, 00000004.00000002.2739928267.000001E3BAA70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: s.exe, 00000004.00000002.2738625706.000001E3BA39C000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/3020
Source: s.exe, 00000004.00000003.1614344119.000001E3B9B6E000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA3FB000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9BE3000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: s.exe, 00000004.00000002.2739025046.000001E3BA3FB000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail/
Source: s.exe, 00000000.00000003.1582408867.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: s.exe, 00000004.00000002.2737906172.000001E3B9BE3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/
Source: s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/get
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/post
Source: s.exe, 00000004.00000002.2741394413.000001E3BBBC4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/json
Source: s.exe, 00000004.00000002.2741394413.000001E3BBBC4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/json96.84MB
Source: s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, request.pyc1.0.dr String found in binary or memory: https://mahler:8092/site-updates.py
Source: s.exe, 00000004.00000002.2739928267.000001E3BAA70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mouseinfo.readthedocs.io
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: s.exe, 00000004.00000002.2739683764.000001E3BA750000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: s.exe, 00000004.00000002.2755273838.00007FFBAB17F000.00000002.00000001.01000000.00000006.sdmp String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: s.exe, 00000004.00000002.2738117362.000001E3B9CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740115692.000001E3BAD58000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://requests.readthedocs.io
Source: s.exe, 00000004.00000002.2737304447.000001E3B97E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: s.exe, 00000004.00000002.2740476062.000001E3BB030000.00000004.00001000.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740476062.000001E3BB100000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/a/20982715/185510
Source: s.exe, 00000004.00000002.2739426839.000001E3BA550000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/18905702/python-ctypes-and-mutable-buffers
Source: s.exe, 00000004.00000002.2737680760.000001E3B9AE0000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA150000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: s.exe, 00000004.00000002.2740350007.000001E3BAF10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: s.exe, 00000004.00000002.2739426839.000001E3BA550000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c
Source: tk.tcl.0.dr String found in binary or memory: https://support.apple.com/en-us/HT201236
Source: s.exe, 00000000.00000003.1582408867.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA3FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: s.exe, 00000000.00000003.1477049478.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: s.exe, 00000000.00000003.1478722709.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: s.exe, 00000004.00000003.1614344119.000001E3B9B6E000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9BE3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: s.exe, 00000004.00000002.2739928267.000001E3BAA70000.00000004.00001000.00020000.00000000.sdmp, connection.pyc0.0.dr String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: s.exe, 00000004.00000002.2740022516.000001E3BAB80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: s.exe, 00000000.00000003.1581690829.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp, connectionpool.pyc.0.dr String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20240227115053/https://exiv2.org/tags.html)
Source: s.exe, 00000004.00000002.2736496223.000001E3B7560000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: s.exe, 00000000.00000003.1573138762.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: s.exe, 00000004.00000002.2749789789.00007FFBAA07B000.00000002.00000001.01000000.0000001C.sdmp, s.exe, 00000004.00000002.2751668681.00007FFBAA3C9000.00000002.00000001.01000000.0000001B.sdmp String found in binary or memory: https://www.openssl.org/H
Source: pyopenssl.pyc.0.dr String found in binary or memory: https://www.pyopenssl.org
Source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.python.org
Source: s.exe, 00000004.00000002.2739025046.000001E3BA416000.00000004.00000020.00020000.00000000.sdmp, request.pyc1.0.dr String found in binary or memory: https://www.python.org/
Source: s.exe, 00000004.00000002.2737579103.000001E3B99E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: s.exe, 00000004.00000002.2737104022.000001E3B93A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: s.exe, 00000000.00000003.1476029562.000001BAE3A74000.00000004.00000020.00020000.00000000.sdmp, _EKSBlowfish.pyc.0.dr String found in binary or memory: https://www.usenix.org/legacy/events/usenix99/provos/provos_html/node4.html
Source: s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: s.exe, 00000004.00000002.2741154458.000001E3BB450000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740999674.000001E3BB34D000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB1A3000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2740610722.000001E3BB198000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: s.exe, 00000004.00000002.2739025046.000001E3BA3FB000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Contains functionality to call native functions
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E91E90 PyList_New,GetActiveProcessorCount,PyErr_SetFromWindowsErr,_Py_Dealloc,free,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,Py_BuildValue,PyList_Append,_Py_Dealloc,free,_Py_Dealloc, 4_2_00007FFBA9E91E90
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E92480 GetActiveProcessorCount,PyErr_SetFromWindowsErr,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,NtQuerySystemInformation,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,free,free,free,free,Py_BuildValue, 4_2_00007FFBA9E92480
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E94680 PyArg_ParseTuple,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,Py_BuildValue,PyUnicode_FromWideChar,GetProcessHeap,HeapFree,PyErr_NoMemory, 4_2_00007FFBA9E94680
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E94A70 PyArg_ParseTuple,OpenProcess,GetLastError,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,PyExc_RuntimeError,PyErr_SetString,CloseHandle,PyErr_Clear,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,Py_BuildValue,PyErr_NoMemory,CloseHandle, 4_2_00007FFBA9E94A70
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E96250 GetProcessHeap,HeapAlloc,GetFileType,SetLastError,NtQueryObject,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,PyErr_NoMemory,GetProcessHeap,HeapFree, 4_2_00007FFBA9E96250
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E96E40 PyExc_RuntimeError,PyErr_SetString,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,NtQueryInformationProcess,calloc,PyErr_NoMemory,free,CloseHandle,wcscpy_s,free,CloseHandle, 4_2_00007FFBA9E96E40
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E95720 PyArg_ParseTuple,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,Py_BuildValue, 4_2_00007FFBA9E95720
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E95810 PyArg_ParseTuple,OpenProcess,GetLastError,NtSetInformationProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct, 4_2_00007FFBA9E95810
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E94D00 PyArg_ParseTuple,OpenProcess,GetLastError,PyObject_IsTrue,NtSuspendProcess,NtResumeProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct, 4_2_00007FFBA9E94D00
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E96600 PyList_New,EnterCriticalSection,GetProcessHeap,HeapAlloc,PyErr_NoMemory,_Py_Dealloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,PyExc_RuntimeError,PyErr_SetString,GetCurrentProcess,DuplicateHandle,PyUnicode_FromWideChar,PyList_Append,_Py_Dealloc,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,_Py_Dealloc,GetProcessHeap,HeapFree,LeaveCriticalSection, 4_2_00007FFBA9E96600
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E973F0 malloc,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,free,free, 4_2_00007FFBA9E973F0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E96AA0 OpenProcess,GetLastError,NtQueryInformationProcess,RtlNtStatusToDosErrorNoTeb,PyErr_SetFromWindowsErrWithFilename,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,ReadProcessMemory,NtQueryInformationProcess,CloseHandle,ReadProcessMemory,ReadProcessMemory,VirtualQueryEx,GetLastError,PyErr_SetFromWindowsErrWithFilename,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,free,CloseHandle, 4_2_00007FFBA9E96AA0
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B4BC: DeviceIoControl, 4_2_70B2B4BC
Detected potential crypto function
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A92AFFE 0_2_00007FF78A92AFFE
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A9276E0 0_2_00007FF78A9276E0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A92D3B0 0_2_00007FF78A92D3B0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A9353FB 0_2_00007FF78A9353FB
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A92B0AF 0_2_00007FF78A92B0AF
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A928CE0 0_2_00007FF78A928CE0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A922090 0_2_00007FF78A922090
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A92B065 0_2_00007FF78A92B065
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A92D9D0 0_2_00007FF78A92D9D0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A92EDE0 0_2_00007FF78A92EDE0
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A92B123 0_2_00007FF78A92B123
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A92B132 0_2_00007FF78A92B132
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A929E20 0_2_00007FF78A929E20
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A929280 0_2_00007FF78A929280
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A922270 0_2_00007FF78A922270
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A0E6F0 4_2_70A0E6F0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A0A7B0 4_2_70A0A7B0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A0F7C0 4_2_70A0F7C0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A6FFB0 4_2_70A6FFB0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A3A0A0 4_2_70A3A0A0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A77190 4_2_70A77190
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A27110 4_2_70A27110
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A3B110 4_2_70A3B110
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A5E140 4_2_70A5E140
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A6E150 4_2_70A6E150
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A0F220 4_2_70A0F220
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A38270 4_2_70A38270
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A36250 4_2_70A36250
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A013E0 4_2_70A013E0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A6C330 4_2_70A6C330
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A3D310 4_2_70A3D310
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A22360 4_2_70A22360
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A57370 4_2_70A57370
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A265B0 4_2_70A265B0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A965E0 4_2_70A965E0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A7E510 4_2_70A7E510
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A31570 4_2_70A31570
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A22540 4_2_70A22540
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A3B550 4_2_70A3B550
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A436D0 4_2_70A436D0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A6D630 4_2_70A6D630
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A40700 4_2_70A40700
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A3D800 4_2_70A3D800
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A3E860 4_2_70A3E860
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A7D910 4_2_70A7D910
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A23940 4_2_70A23940
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A43950 4_2_70A43950
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A35AF0 4_2_70A35AF0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A6BB70 4_2_70A6BB70
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A3EC80 4_2_70A3EC80
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A34C20 4_2_70A34C20
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A6CC15 4_2_70A6CC15
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A24DA0 4_2_70A24DA0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A7DDF0 4_2_70A7DDF0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A38DC0 4_2_70A38DC0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A6EDC0 4_2_70A6EDC0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A2BD40 4_2_70A2BD40
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A41D40 4_2_70A41D40
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A07E20 4_2_70A07E20
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A31E30 4_2_70A31E30
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A29E70 4_2_70A29E70
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A18E40 4_2_70A18E40
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A56FE2 4_2_70A56FE2
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A3CF20 4_2_70A3CF20
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A36F00 4_2_70A36F00
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A26F70 4_2_70A26F70
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D32430 4_2_00007FFBA9D32430
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D31FD0 4_2_00007FFBA9D31FD0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D445D0 4_2_00007FFBA9D445D0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D44820 4_2_00007FFBA9D44820
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D51D80 4_2_00007FFBA9D51D80
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D51FF0 4_2_00007FFBA9D51FF0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D529C0 4_2_00007FFBA9D529C0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D52EC0 4_2_00007FFBA9D52EC0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D53550 4_2_00007FFBA9D53550
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D524A0 4_2_00007FFBA9D524A0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D62110 4_2_00007FFBA9D62110
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D61D40 4_2_00007FFBA9D61D40
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D71F10 4_2_00007FFBA9D71F10
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D721C0 4_2_00007FFBA9D721C0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D91FA0 4_2_00007FFBA9D91FA0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DA1F40 4_2_00007FFBA9DA1F40
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DA2050 4_2_00007FFBA9DA2050
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DB1D40 4_2_00007FFBA9DB1D40
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DB22D0 4_2_00007FFBA9DB22D0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DC2160 4_2_00007FFBA9DC2160
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E551C4 4_2_00007FFBA9E551C4
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E5F1B0 4_2_00007FFBA9E5F1B0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E631A9 4_2_00007FFBA9E631A9
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E5FD00 4_2_00007FFBA9E5FD00
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E5E0B0 4_2_00007FFBA9E5E0B0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E5A880 4_2_00007FFBA9E5A880
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E54C80 4_2_00007FFBA9E54C80
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E5BC40 4_2_00007FFBA9E5BC40
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E55754 4_2_00007FFBA9E55754
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E5D6F0 4_2_00007FFBA9E5D6F0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E5EEE0 4_2_00007FFBA9E5EEE0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E58EBC 4_2_00007FFBA9E58EBC
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E91E90 4_2_00007FFBA9E91E90
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E92E70 4_2_00007FFBA9E92E70
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E92B00 4_2_00007FFBA9E92B00
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E93990 4_2_00007FFBA9E93990
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E98F30 4_2_00007FFBA9E98F30
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E96600 4_2_00007FFBA9E96600
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E94DF0 4_2_00007FFBA9E94DF0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E999D0 4_2_00007FFBA9E999D0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9EB1860 4_2_00007FFBA9EB1860
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\s.exe Code function: String function: 70A04230 appears 238 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 70A2D400 appears 325 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FF78A922930 appears 39 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 70A96CA0 appears 192 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FFBA9E91D70 appears 39 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FFBA9E91070 appears 43 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 70A96730 appears 31 times
Source: C:\Users\user\Desktop\s.exe Code function: String function: 00007FFBA9E7779C appears 32 times
PE file contains executable resources (Code or Archives)
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file does not import any functions
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs s.exe
Source: s.exe Binary or memory string: OriginalFilename vs s.exe
Source: s.exe, 00000004.00000002.2757110059.00007FFBB4C4E000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: OriginalFilename_tkinter.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2759903454.00007FFBBCA27000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs s.exe
Source: s.exe, 00000004.00000002.2759497002.00007FFBBC709000.00000002.00000001.01000000.00000012.sdmp Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs s.exe
Source: s.exe, 00000004.00000002.2754408569.00007FFBAAD51000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: OriginalFilenamewin32api.pyd0 vs s.exe
Source: s.exe, 00000004.00000002.2756097889.00007FFBAB95D000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilenamepyexpat.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2756928630.00007FFBB18A4000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2755028424.00007FFBAAE31000.00000002.00000001.01000000.00000011.sdmp Binary or memory string: OriginalFilenamepywintypes310.dll0 vs s.exe
Source: s.exe, 00000004.00000002.2756550488.00007FFBABB3C000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs s.exe
Source: s.exe, 00000004.00000002.2758486612.00007FFBB62AD000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2759133725.00007FFBBBE94000.00000002.00000001.01000000.00000023.sdmp Binary or memory string: OriginalFilename_uuid.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2756287073.00007FFBABA3E000.00000002.00000001.01000000.0000001D.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2749138584.00007FFBA9FC1000.00000002.00000001.01000000.00000020.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2755880910.00007FFBAB288000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamepython310.dll. vs s.exe
Source: s.exe, 00000004.00000002.2736902585.000001E3B8EF0000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs s.exe
Source: s.exe, 00000004.00000002.2760082954.00007FFBBCD56000.00000002.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2759699259.00007FFBBCA06000.00000002.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2757706252.00007FFBB5C22000.00000002.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2753491777.00007FFBAA942000.00000002.00000001.01000000.00000018.sdmp Binary or memory string: OriginalFilenametk86.dllP vs s.exe
Source: s.exe, 00000004.00000002.2748048930.00007FFBA9E8A000.00000002.00000001.01000000.00000022.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2749789789.00007FFBAA07B000.00000002.00000001.01000000.0000001C.sdmp Binary or memory string: OriginalFilenamelibsslH vs s.exe
Source: s.exe, 00000004.00000002.2758084261.00007FFBB5CD2000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2754130047.00007FFBAAD25000.00000002.00000001.01000000.0000001A.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs s.exe
Source: s.exe, 00000004.00000002.2751668681.00007FFBAA3C9000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs s.exe
Source: s.exe, 00000004.00000002.2754808046.00007FFBAAE04000.00000002.00000001.01000000.00000013.sdmp Binary or memory string: OriginalFilenamepythoncom310.dll0 vs s.exe
Source: s.exe, 00000004.00000002.2753083666.00007FFBAA7D8000.00000002.00000001.01000000.00000017.sdmp Binary or memory string: OriginalFilenametcl86.dllP vs s.exe
Source: s.exe Static PE information: Section: .rsrc ZLIB complexity 0.9902948700221239
Source: classification engine Classification label: mal60.troj.evad.winEXE@20/1027@2/2
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A928560 GetLastError,FormatMessageW,WideCharToMultiByte, 0_2_00007FF78A928560
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E97DB0 GetCurrentProcess,OpenProcessToken,GetLastError,ImpersonateSelf,OpenProcessToken,GetLastError,PyErr_SetFromWindowsErrWithFilename,LookupPrivilegeValueA,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,RevertToSelf,CloseHandle, 4_2_00007FFBA9E97DB0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E92A30 PyArg_ParseTuple,PyUnicode_AsWideCharString,PyEval_SaveThread,GetDiskFreeSpaceExW,PyEval_RestoreThread,PyMem_Free,PyExc_OSError,PyErr_SetExcFromWindowsErrWithFilenameObject,Py_BuildValue, 4_2_00007FFBA9E92A30
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E9601F PyDict_New,memset,CreateToolhelp32Snapshot,PyErr_SetFromWindowsErr,_Py_Dealloc,Process32First,PyLong_FromLong,PyLong_FromLong,PyDict_SetItem,_Py_Dealloc,_Py_Dealloc,Process32Next,CloseHandle,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseHandle, 4_2_00007FFBA9E9601F
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E98AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct, 4_2_00007FFBA9E98AA0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4152:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4788:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4932:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6136:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6632:120:WilError_03
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802 Jump to behavior
Source: s.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\s.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\s.exe File read: C:\Users\user\Desktop\s.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\s.exe "C:\Users\user\Desktop\s.exe"
Source: C:\Users\user\Desktop\s.exe Process created: C:\Users\user\Desktop\s.exe "C:\Users\user\Desktop\s.exe"
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber
Source: C:\Windows\System32\wbem\WMIC.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic baseboard get manufacturer
Source: C:\Windows\System32\wbem\WMIC.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic baseboard get manufacturer
Source: C:\Windows\System32\wbem\WMIC.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\s.exe Process created: C:\Users\user\Desktop\s.exe "C:\Users\user\Desktop\s.exe" Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic baseboard get manufacturer Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic baseboard get manufacturer Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: libffi-7.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: tcl86t.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: tk86t.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\s.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Users\user\Desktop\s.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\Desktop\pyvenv.cfg Jump to behavior
Source: s.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: s.exe Static file information: File size 20877959 > 1048576
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: s.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: s.exe, 00000004.00000002.2754574487.00007FFBAADBC000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: s.exe, 00000004.00000002.2747877494.00007FFBA9E79000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: ucrtbase.pdb source: s.exe, 00000004.00000002.2756457718.00007FFBABB01000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: s.exe, 00000004.00000002.2756812573.00007FFBB189B000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: s.exe, 00000004.00000002.2747877494.00007FFBA9E79000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: .pdbrcO` source: s.exe, 00000004.00000002.2739819511.000001E3BA970000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: s.exe, 00000004.00000002.2759416244.00007FFBBC705000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: ~/.pdbrc source: s.exe, 00000004.00000002.2739819511.000001E3BA970000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: placed in the .pdbrc file): source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: s.exe, 00000004.00000002.2757039470.00007FFBB4C48000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: pdb.Pdb source: s.exe, 00000004.00000002.2739819511.000001E3BA970000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: s.exe, 00000004.00000002.2754945356.00007FFBAAE20000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: s.exe, 00000004.00000002.2750653622.00007FFBAA2D0000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: s.exe, 00000004.00000002.2759829624.00007FFBBCA21000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: s.exe, 00000004.00000002.2758408188.00007FFBB62A0000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: s.exe, 00000004.00000002.2756209342.00007FFBABA36000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: s.exe, 00000004.00000002.2754307372.00007FFBAAD43000.00000002.00000001.01000000.00000014.sdmp, win32api.pyd.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: s.exe, 00000004.00000002.2756014940.00007FFBAB952000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: s.exe, 00000004.00000002.2754307372.00007FFBAAD43000.00000002.00000001.01000000.00000014.sdmp, win32api.pyd.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: s.exe, 00000004.00000002.2756812573.00007FFBB189B000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: s.exe, 00000004.00000002.2757999183.00007FFBB5CCD000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: win32trace.pyd.0.dr
Source: Binary string: ucrtbase.pdbUGP source: s.exe, 00000004.00000002.2756457718.00007FFBABB01000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: s.exe, 00000004.00000002.2757607453.00007FFBB5C18000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: s.exe, 00000000.00000003.1580175754.000001BAE3AA6000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2748429315.00007FFBA9FBC000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: s.exe, 00000004.00000002.2749640819.00007FFBAA046000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: s.exe, 00000004.00000002.2754574487.00007FFBAADBC000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: s.exe, 00000004.00000002.2750653622.00007FFBAA2D0000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdbGCTL source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: -c are executed after commands from .pdbrc files. source: s.exe, 00000004.00000003.1614344119.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: s.exe, 00000004.00000002.2750653622.00007FFBAA352000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: s.exe, 00000004.00000002.2749640819.00007FFBAA046000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: s.exe, 00000004.00000002.2760013090.00007FFBBCD53000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: s.exe, 00000004.00000003.1614344119.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc source: s.exe, 00000004.00000002.2739819511.000001E3BA970000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: s.exe, 00000004.00000002.2759060026.00007FFBBBE92000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: s.exe, 00000004.00000002.2755273838.00007FFBAB17F000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: s.exe, 00000004.00000002.2759613310.00007FFBBCA03000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: s.exe, 00000004.00000002.2754945356.00007FFBAAE20000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: s.exe, 00000004.00000002.2736902585.000001E3B8EF0000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: s.exe, 00000004.00000003.1614344119.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2737906172.000001E3B9C72000.00000004.00000020.00020000.00000000.sdmp, s.exe, 00000004.00000002.2738625706.000001E3BA297000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: s.exe, 00000004.00000002.2753890539.00007FFBAAD0D000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: s.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: api-ms-win-core-file-l1-1-0.dll.0.dr Static PE information: 0x8AAB288B [Mon Sep 21 18:27:23 2043 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext, 4_2_70A70C90
PE file contains sections with non-standard names
Source: s.exe Static PE information: section name: .buildid
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B4BC push rbp; retf 4_2_70B2B4BF
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B4A4 push r14; retf 4_2_70B2B4A7
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B4AC push rbp; retf 4_2_70B2B4AF
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B49C push rsi; retf 4_2_70B2B49F
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B49C push rsi; retf 4_2_70B2B4E7
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B4FC push rbp; retf 4_2_70B2B4FF
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B4DC push rbp; retf 4_2_70B2B4F7
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B4C4 push rdi; retf 4_2_70B2B4CF
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B474 push rsi; retf 4_2_70B2B49F
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B46C push rsi; retf 4_2_70B2B49F
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B5BC push rsp; retf 4_2_70B2B5BF
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B5A4 push rsi; retf 4_2_70B2B5AF
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B58C push rbp; retf 4_2_70B2B58F
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B5F4 push rbp; retf 4_2_70B2B5F7
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B5CC push rbp; retf 4_2_70B2B5CF
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B52C push rsi; retf 4_2_70B2B52F
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B52C push rbp; retf 4_2_70B2B537
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B504 push rbp; retf 4_2_70B2B507
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B50C push rsi; retf 4_2_70B2B52F
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B554 push rbp; retf 4_2_70B2B55F
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B54C push rbp; retf 4_2_70B2B54F
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B73C pushfq ; retf 4_2_70B2B74E
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B744 pushfq ; retf 4_2_70B2B74E

Persistence and Installation Behavior
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\s.exe Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d 4_2_70A227E0
Source: C:\Users\user\Desktop\s.exe Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d 4_2_70A22B90
Source: C:\Users\user\Desktop\s.exe Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d 4_2_00007FFBA9E92B00
Source: C:\Users\user\Desktop\s.exe Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i 4_2_00007FFBA9E92B00
Source: C:\Users\user\Desktop\s.exe Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i 4_2_00007FFBA9E92B00
Source: C:\Users\user\Desktop\s.exe Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i 4_2_00007FFBA9E92B00
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\s.exe Process created: "C:\Users\user\Desktop\s.exe"
Drops PE files
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\tcl86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_blowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_arc2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_keccak.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\PublicKey\_x25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\charset_normalizer\md__mypyc.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_RIPEMD160.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\charset_normalizer\md.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_des.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_BLAKE2b.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA384.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_MD2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\PublicKey\_ec_ws.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\PublicKey\_ed448.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_ARC4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_cast.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_MD4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA224.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\PublicKey\_ed25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\win32com\shell\shell.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_des3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA512.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_chacha20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Math\_modexp.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_poly1305.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_pkcs1_decode.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe File created: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_MD5.pyd Jump to dropped file

Boot Survival
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\s.exe Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d 4_2_70A227E0
Source: C:\Users\user\Desktop\s.exe Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d 4_2_70A22B90
Source: C:\Users\user\Desktop\s.exe Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d 4_2_00007FFBA9E92B00
Source: C:\Users\user\Desktop\s.exe Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i 4_2_00007FFBA9E92B00
Source: C:\Users\user\Desktop\s.exe Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i 4_2_00007FFBA9E92B00
Source: C:\Users\user\Desktop\s.exe Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i 4_2_00007FFBA9E92B00
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E98AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct, 4_2_00007FFBA9E98AA0
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A926F90 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00007FF78A926F90
Source: C:\Users\user\Desktop\s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\s.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Contains functionality to enumerate running services
Source: C:\Users\user\Desktop\s.exe Code function: PyList_New,OpenSCManagerA,GetLastError,PyErr_SetFromWindowsErrWithFilename,EnumServicesStatusExW,GetLastError,free,malloc,EnumServicesStatusExW,PyUnicode_FromWideChar,PyUnicode_FromWideChar,Py_BuildValue,PyList_Append,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free, 4_2_00007FFBA9E98170
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_blowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_arc2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_keccak.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\PublicKey\_x25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\charset_normalizer\md__mypyc.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_RIPEMD160.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\charset_normalizer\md.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_des.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_BLAKE2b.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA384.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_MD2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\PublicKey\_ec_ws.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\PublicKey\_ed448.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_ARC4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_cast.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_MD4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA224.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\win32com\shell\shell.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\PublicKey\_ed25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_raw_des3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_SHA512.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_chacha20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Math\_modexp.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_poly1305.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Cipher\_pkcs1_decode.pyd Jump to dropped file
Source: C:\Users\user\Desktop\s.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52802\Crypto\Hash\_MD5.pyd Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\s.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\s.exe API coverage: 3.1 %
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BIOS
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_BaseBoard
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_BaseBoard
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\s.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A928C20 FindFirstFileExW,FindClose, 0_2_00007FF78A928C20
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E92E70 memset,PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,SetErrorMode,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,strcat_s,SetLastError,strcat_s,strcat_s,strcat_s,FindFirstVolumeMountPointA,strcpy_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,FindNextVolumeMountPointA,FindVolumeMountPointClose,strcat_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,strchr,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,_Py_Dealloc,_Py_Dealloc, 4_2_00007FFBA9E92E70
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A06A70 GetSystemInfo,VirtualAlloc,VirtualAlloc, 4_2_70A06A70
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI52802\tcl\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI52802\ Jump to behavior
Source: C:\Users\user\Desktop\s.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: cacert.pem.0.dr Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vboxtray
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware SVGA 3D
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vboxservice
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: qemu-ga
Source: s.exe, 00000004.00000002.2740610722.000001E3BB1D4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware S
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Microsoft Hyper-V Video
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwareuser
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmusrvc
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmsrvc
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmtoolsd
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwaretray
Source: s.exe, 00000004.00000002.2737680760.000001E3B9AE0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: s.exe, 00000004.00000002.2741394413.000001E3BBB38000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwareservice
Source: cacert.pem.0.dr Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: C:\Users\user\Desktop\s.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\s.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A70C60 IsDebuggerPresent,IsDebuggerPresent, 4_2_70A70C60
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext, 4_2_70A70C90
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A22360 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersAddresses,memcpy,GetProcessHeap,HeapFree, 4_2_70A22360
Enables debug privileges
Source: C:\Users\user\Desktop\s.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\s.exe Code function: 0_2_00007FF78A921160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,wcslen,malloc,memcpy,_cexit, 0_2_00007FF78A921160
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A95380 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort, 4_2_70A95380
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70B2B5CC SetUnhandledExceptionFilter, 4_2_70B2B5CC
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A96F81 SetUnhandledExceptionFilter, 4_2_70A96F81
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D238BC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9D238BC
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D23E7C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9D23E7C
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D31390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9D31390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D31960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9D31960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D41390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9D41390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D41960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9D41960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D51390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9D51390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D51960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9D51960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D61390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9D61390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D61960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9D61960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D71390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9D71390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D71960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9D71960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D81390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9D81390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D81960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9D81960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D91390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9D91390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D91960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9D91960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DA1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9DA1390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DA1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9DA1960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DB1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9DB1390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DB1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9DB1960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DC1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9DC1390
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9DC1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9DC1960
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E6FD80 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9E6FD80
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E706A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9E706A8
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E9A978 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9E9A978
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9E9A050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9E9A050
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9EB2A60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_00007FFBA9EB2A60
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9EB3028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FFBA9EB3028
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\s.exe Process created: C:\Users\user\Desktop\s.exe "C:\Users\user\Desktop\s.exe" Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic baseboard get manufacturer Jump to behavior
Source: C:\Users\user\Desktop\s.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic baseboard get manufacturer Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_00007FFBA9D81D70 cpuid 4_2_00007FFBA9D81D70
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\Desktop\s.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_ctypes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes\_endian.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes\_endian.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes\_endian.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ctypes\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\shutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\shutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\shutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\fnmatch.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\bz2.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\bz2.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\bz2.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_compression.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_compression.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_compression.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\lzma.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\lzma.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\lzma.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_lzma.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\subprocess.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\subprocess.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\subprocess.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\signal.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\signal.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\signal.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\threading.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\threading.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\threading.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\contextlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\contextlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\contextlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-console-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-datetime-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-debug-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-errorhandling-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-file-l1-2-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-file-l2-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-handle-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-localization-l1-2-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-memory-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-profile-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-synch-l1-2-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-core-util-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-conio-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-convert-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-environment-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-heap-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-math-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-multibyte-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\api-ms-win-crt-runtime-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\argparse.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ast.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\datetime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\selectors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ssl.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\string.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\struct.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tk VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\token.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\inspect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\inspect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\inspect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ast.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ast.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\ast.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\dis.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\dis.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\dis.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\opcode.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\opcode.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\opcode.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\machinery.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\machinery.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\machinery.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tokenize.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tokenize.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tokenize.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\token.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\token.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\token.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pathlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pathlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pathlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\urllib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\urllib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\urllib\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\urllib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\urllib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\urllib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\urllib\parse.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\urllib\parse.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\urllib\parse.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkgutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkgutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkgutil.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\_abc.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\_abc.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\_abc.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_pyi_rth_utils\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_pyi_rth_utils\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_pyi_rth_utils\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\context.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\context.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\context.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\process.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\process.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\process.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\reduction.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\reduction.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\reduction.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_compat_pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_compat_pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_compat_pickle.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\socket.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\socket.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\socket.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\_socket.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\selectors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\selectors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\selectors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\select.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\spawn.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\spawn.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\spawn.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\runpy.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\runpy.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\runpy.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\util.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\popen_spawn_win32.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\popen_spawn_win32.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\multiprocessing\popen_spawn_win32.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tk VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\zipfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\zipfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\zipfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\platform.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\platform.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\platform.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\plistlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\plistlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\plistlib.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\datetime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\datetime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\datetime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\parsers\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\parsers\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\parsers\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\parsers VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\parsers VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\parsers\expat.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\parsers\expat.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\xml\parsers\expat.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pyexpat.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\parser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\parser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\parser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\feedparser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\feedparser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\feedparser.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\errors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\errors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\errors.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\_policybase.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\_policybase.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\_policybase.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\header.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\header.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\header.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\quoprimime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\quoprimime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\quoprimime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\string.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\string.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\string.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\base64mime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\base64mime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\base64mime.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base64.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base64.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base64.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\charset.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\charset.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\charset.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\encoders.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\encoders.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\encoders.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\quopri.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\quopri.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\quopri.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\utils.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\utils.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\utils.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\random.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\random.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\random.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\bisect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\bisect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\bisect.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\_parseaddr.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\_parseaddr.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\email\_parseaddr.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\calendar.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\calendar.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\calendar.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tempfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tempfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\tempfile.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\textwrap.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\textwrap.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\textwrap.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\extern\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\extern\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\extern\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\extern VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\extern VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\extern VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\jaraco\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\jaraco\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\jaraco\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\jaraco VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\jaraco VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\jaraco VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\jaraco\text\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\jaraco\text\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\pkg_resources\_vendor\jaraco\text\__init__.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\resources.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\resources.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib\resources.pyc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52802\importlib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A952A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 4_2_70A952A0
Source: C:\Users\user\Desktop\s.exe Code function: 4_2_70A70CFC GetVersion,GetCurrentThread, 4_2_70A70CFC
Source: C:\Users\user\Desktop\s.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1428702 Sample: s.exe Startdate: 19/04/2024 Architecture: WINDOWS Score: 60 45 api.telegram.org 2->45 47 ipinfo.io 2->47 9 s.exe 1119 2->9         started        signatures3 53 Uses the Telegram API (likely for C&C communication) 45->53 process4 file5 37 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 9->37 dropped 39 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 9->39 dropped 41 C:\Users\user\AppData\Local\...\win32api.pyd, PE32+ 9->41 dropped 43 83 other files (none is malicious) 9->43 dropped 55 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->55 57 Contains functionality to infect the boot sector 9->57 59 Found pyInstaller with non standard icon 9->59 13 s.exe 4 9->13         started        signatures6 process7 dnsIp8 49 api.telegram.org 149.154.167.220, 443, 49718 TELEGRAMRU United Kingdom 13->49 51 ipinfo.io 34.117.186.192, 443, 49717 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 13->51 61 Hides threads from debuggers 13->61 17 cmd.exe 1 13->17         started        19 cmd.exe 1 13->19         started        21 WMIC.exe 13->21         started        23 2 other processes 13->23 signatures9 process10 process11 25 WMIC.exe 1 17->25         started        27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        31 conhost.exe 21->31         started        33 conhost.exe 23->33         started        35 conhost.exe 23->35         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.186.192
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false

Contacted Domains

Name IP Active
ipinfo.io 34.117.186.192 true
api.telegram.org 149.154.167.220 true