Windows Analysis Report
purchaseorder4.exe

Overview

General Information

Sample name: purchaseorder4.exe
Analysis ID: 1428748
MD5: 5914b824880c616d105867599dac3d76
SHA1: e55db01b770d5371a83be03f9e4a3f4b4520380e
SHA256: 49c7e194b5876770a6e8e680c8b606ab07ffca891d4921be7a38f9d600347b1b
Infos:

Detection

Python Stealer
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users
Detected generic credential text file
Found pyInstaller with non standard icon
Initial sample is a PE file and has a suspicious name
Performs DNS queries to domains with low reputation
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Generic Python Stealer
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Outbound SMTP Connections

Classification

Source: purchaseorder4.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: purchaseorder4.exe, 00000002.00000002.2393327241.00007FF8B61CC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: purchaseorder4.exe, 00000002.00000002.2389528884.00007FF8A82AC000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: ucrtbase.pdb source: purchaseorder4.exe, 00000002.00000002.2395097234.00007FF8B80CC000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: purchaseorder4.exe, 00000002.00000002.2396996550.00007FF8B90FB000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: tRSA_PRIME_INFOeqdmp1dmq1iqmpprime_infosRSAPrivateKeyRSAPublicKeyhashAlgorithmmaskGenAlgorithmsaltLengthtrailerFieldRSA_PSS_PARAMShashFuncmaskGenFuncpSourceFuncRSA_OAEP_PARAMScompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 23 00:13:44 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: purchaseorder4.exe, 00000002.00000002.2390759212.00007FF8A8AA6000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: purchaseorder4.exe, 00000000.00000003.2286951405.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2396332002.00007FF8B8CB5000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdb source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: purchaseorder4.exe, 00000002.00000002.2393327241.00007FF8B61CC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: purchaseorder4.exe, 00000002.00000002.2390218021.00007FF8A8510000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdbo source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: purchaseorder4.exe, 00000002.00000002.2389356129.00007FF8A8151000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: purchaseorder4.exe, 00000002.00000002.2394435263.00007FF8B78B0000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: purchaseorder4.exe, 00000002.00000002.2390218021.00007FF8A8592000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: purchaseorder4.exe, 00000002.00000002.2390759212.00007FF8A8AA6000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: purchaseorder4.exe, 00000002.00000002.2390218021.00007FF8A8510000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: purchaseorder4.exe, 00000000.00000003.2286728644.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2398128067.00007FF8BFAD1000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: purchaseorder4.exe, 00000002.00000002.2397697062.00007FF8B9F70000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: purchaseorder4.exe, 00000002.00000002.2393143390.00007FF8B6046000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: crypto\engine\tb_digest.cENGINE_get_digestcrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancrypto\packet.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: purchaseorder4.exe, 00000002.00000002.2394002737.00007FF8B7833000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2395553131.00007FF8B8257000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: purchaseorder4.exe, 00000002.00000002.2394002737.00007FF8B7833000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: purchaseorder4.exe, 00000002.00000002.2391270361.00007FF8A8E1F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: purchaseorder4.exe, 00000002.00000002.2394839291.00007FF8B8002000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: purchaseorder4.exe, 00000002.00000002.2396567848.00007FF8B8F73000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: purchaseorder4.exe, 00000002.00000002.2396996550.00007FF8B90FB000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2397257835.00007FF8B93CD000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: purchaseorder4.exe, 00000002.00000002.2394435263.00007FF8B78B0000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: ucrtbase.pdbUGP source: purchaseorder4.exe, 00000002.00000002.2395097234.00007FF8B80CC000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: purchaseorder4.exe, 00000002.00000002.2396757605.00007FF8B8F88000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: purchaseorder4.exe, 00000002.00000002.2387746863.000002607FD20000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: purchaseorder4.exe, 00000002.00000002.2393722010.00007FF8B77FD000.00000002.00000001.01000000.00000014.sdmp
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781708D00 FindFirstFileExW,FindClose, 0_2_00007FF781708D00
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781718670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF781718670
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF7817226C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF7817226C4
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781718670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF781718670
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-datetime-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-console-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602 Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\pythonwin Jump to behavior

Networking
barindex
Performs DNS queries to domains with low reputation
Source: DNS query: mail.dasmake.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 192.236.232.35 192.236.232.35
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: HOSTWINDSUS HOSTWINDSUS
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown DNS traffic detected: queries for: mail.dasmake.xyz
Source: purchaseorder4.exe, 00000002.00000002.2385896663.000002600374C000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2321108231.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2321055713.0000026002D08000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://.../back.jpeg
Source: purchaseorder4.exe, 00000002.00000002.2385639108.00000260033A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://aka.ms/vcpython27
Source: purchaseorder4.exe, 00000002.00000002.2385639108.00000260033A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://aka.ms/vcpython27P
Source: purchaseorder4.exe, 00000002.00000003.2362913745.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.00000260021D1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373172224.00000260021F8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365786087.000002600247A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363347083.0000026002501000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2375092092.00000260023E9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366999934.000002600247D000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367178720.00000260023E8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376930091.00000260021E5000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.00000260024A9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365615919.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366123429.0000026002504000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377547206.00000260023E9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.000002600247A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2378170065.0000026002504000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377137380.0000026002504000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363847601.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: purchaseorder4.exe, 00000002.00000002.2386004860.00000260038F8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://bugs.python.org/issue23606)
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: purchaseorder4.exe, 00000002.00000002.2386004860.0000026003810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations
Source: purchaseorder4.exe, 00000002.00000003.2362913745.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.0000026002229000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2314990918.0000026001A0D000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368804066.0000026002228000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.00000260024BE000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2312013424.00000260019FF000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362456773.0000026002524000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362263286.000002600250A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369607616.0000026002530000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2312782863.0000026001A0E000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002191000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2371227342.0000026002531000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364800314.0000026001A0F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: purchaseorder4.exe, 00000002.00000003.2313024105.0000026001DAF000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372608702.0000026001DB2000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2374030431.0000026001DB6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364596999.0000026001D7F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364489827.0000026001CE1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366325101.0000026001D9E000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: purchaseorder4.exe, 00000002.00000003.2379431977.0000026002C9F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2383700298.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369708079.0000026002C9B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369892028.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362795977.0000026002BA1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366063143.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: purchaseorder4.exe, 00000002.00000003.2373782096.0000026002D59000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373616727.0000026002D51000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361633539.0000026003079000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361673045.0000026002D4A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2384596162.0000026002DB8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl
Source: purchaseorder4.exe, 00000002.00000003.2361633539.0000026003079000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.00000260024A9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363477134.00000260024AD000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2383002229.00000260024AE000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370665649.00000260024AE000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372968442.00000260024AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: purchaseorder4.exe, 00000002.00000002.2383700298.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369892028.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362795977.0000026002BA1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366063143.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crlZS
Source: purchaseorder4.exe, 00000002.00000002.2383700298.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369892028.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362795977.0000026002BA1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366063143.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crlkrxlsH588249-
Source: purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl
Source: purchaseorder4.exe, 00000002.00000003.2363391268.0000026002BBC000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365615919.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363847601.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362795977.0000026002BA1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362323038.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376124949.0000026002D04000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376606966.0000026002D24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: purchaseorder4.exe, 00000002.00000002.2383700298.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369892028.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362795977.0000026002BA1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366063143.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crlFE
Source: purchaseorder4.exe, 00000002.00000002.2383700298.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369892028.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362795977.0000026002BA1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366063143.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crlhhxAyAevrNQn
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: purchaseorder4.exe, 00000002.00000003.2365615919.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363847601.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376865609.0000026002D0C000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2382240128.0000026002190000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362323038.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376124949.0000026002D04000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: purchaseorder4.exe, 00000002.00000002.2384762588.0000026002E32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publicatio
Source: purchaseorder4.exe, 00000002.00000003.2362913745.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373172224.00000260021F8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365786087.000002600247A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366999934.000002600247D000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.000002600247A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361673045.0000026002DD8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373921602.000002600247F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.000002600247A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: purchaseorder4.exe, 00000002.00000003.2363347083.0000026002501000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2375092092.00000260023E9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367178720.00000260023E8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.00000260024A9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366123429.0000026002504000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377547206.00000260023E9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2378170065.0000026002504000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377137380.0000026002504000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377431655.0000026002504000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372434824.0000026002504000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2382735562.00000260023E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: purchaseorder4.exe, 00000002.00000003.2362913745.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2381915772.0000026001E18000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373172224.00000260021F8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366965400.0000026001DFB000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373782096.0000026002D59000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2387831051.000002607FDE0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373616727.0000026002D51000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2385896663.000002600374C000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366859785.0000026001DF4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.00000260024A9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364867749.0000026001DE9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2382391801.00000260021F9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367145372.0000026001E00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2383616657.0000026002AA0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2386004860.0000026003810000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372293412.0000026002240000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2375344906.00000260024BF000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362838082.0000026001DCA000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363477134.00000260024AD000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361673045.0000026002D4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: purchaseorder4.exe, 00000002.00000002.2385896663.000002600374C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: purchaseorder4.exe, 00000002.00000002.2385726797.00000260034A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: purchaseorder4.exe, 00000002.00000002.2385726797.00000260034A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: purchaseorder4.exe, 00000002.00000002.2383616657.0000026002AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: purchaseorder4.exe, 00000002.00000002.2383356804.00000260027A0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2312782863.00000260019FE000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2382065051.0000026001F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: purchaseorder4.exe, 00000002.00000003.2362795977.0000026002BA1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/unittest.html
Source: purchaseorder4.exe, 00000002.00000002.2382065051.0000026001F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/ActiveState/appdirs
Source: purchaseorder4.exe, 00000002.00000003.2376472876.0000026002432000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365786087.0000026002408000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002351000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2382735562.0000026002432000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367721039.0000026002412000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369520511.0000026002432000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368437865.000002600242F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: purchaseorder4.exe, 00000002.00000003.2375092092.00000260023E9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367178720.00000260023E8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002351000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377547206.00000260023E9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2382735562.00000260023E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: purchaseorder4.exe, 00000002.00000003.2367178720.00000260023E8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365786087.0000026002408000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002351000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367721039.0000026002412000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369520511.0000026002413000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: purchaseorder4.exe, 00000002.00000003.2372968442.00000260024AE000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364800314.0000026001A0F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com
Source: purchaseorder4.exe, 00000002.00000003.2363391268.0000026002BBC000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361633539.0000026003079000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365615919.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363847601.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362795977.0000026002BA1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362323038.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376124949.0000026002D04000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376606966.0000026002D24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: purchaseorder4.exe, 00000002.00000003.2379431977.0000026002C9F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369708079.0000026002C9B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.comsnippetV
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: purchaseorder4.exe, 00000002.00000002.2381972173.0000026001E90000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2380929512.0000026001B90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: purchaseorder4.exe, 00000002.00000002.2383356804.00000260027A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/questions/19622133/
Source: purchaseorder4.exe, 00000002.00000003.2377263408.00000260021C1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2375092092.00000260023E9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367178720.00000260023E8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377547206.00000260023E9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372716624.00000260021C2000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2382735562.00000260023E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: purchaseorder4.exe, 00000002.00000002.2386004860.0000026003810000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2385813257.00000260035C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: purchaseorder4.exe, 00000002.00000003.2373616727.0000026002D51000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361673045.0000026002D4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: purchaseorder4.exe, 00000002.00000002.2385813257.00000260035C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: purchaseorder4.exe, 00000002.00000003.2376124949.0000026002D28000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365615919.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363847601.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370208370.0000026002D25000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2384296491.0000026002D2A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362323038.0000026002D00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: purchaseorder4.exe, 00000002.00000002.2382065051.0000026001F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: purchaseorder4.exe, 00000002.00000003.2312072659.0000026001DC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: purchaseorder4.exe, 00000002.00000003.2362913745.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.00000260021D1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373172224.00000260021F8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376930091.00000260021E5000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362913745.00000260021CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: purchaseorder4.exe, 00000002.00000002.2386114592.0000026003A80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.dabeaz.com/ply)
Source: purchaseorder4.exe, 00000002.00000002.2382264597.00000260021A1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377263408.0000026002191000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.dabeaz.com/ply)F
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: purchaseorder4.exe, 00000002.00000002.2383856392.0000026002C22000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362383954.0000026002C20000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361568751.0000026002C13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: purchaseorder4.exe, 00000002.00000003.2312072659.0000026001DC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: purchaseorder4.exe, 00000002.00000003.2313024105.0000026001DD1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2312072659.0000026001DC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: purchaseorder4.exe, 00000002.00000003.2376124949.0000026002D28000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365615919.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363847601.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370208370.0000026002D25000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2384296491.0000026002D2A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362323038.0000026002D00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: purchaseorder4.exe, 00000002.00000003.2373616727.0000026002D51000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361673045.0000026002D4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: purchaseorder4.exe, 00000002.00000003.2375614799.0000026002CC4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2384110948.0000026002CC7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2321838846.0000026002CC3000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369708079.0000026002C9B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372864592.0000026002CB6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wwwsearch.sf.net/):
Source: purchaseorder4.exe, 00000002.00000002.2383356804.00000260027A0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2383445652.00000260028A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.python.org/issue44497.
Source: purchaseorder4.exe, 00000002.00000002.2392174415.00007FF8B054C000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: purchaseorder4.exe, 00000002.00000002.2386201220.0000026003C0C000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2386350724.0000026003D40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
Source: purchaseorder4.exe, 00000002.00000003.2368846916.0000026001D0F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365786087.0000026002408000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002351000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367721039.0000026002412000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364489827.0000026001CE1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369520511.0000026002413000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365987293.0000026001CE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: purchaseorder4.exe, 00000002.00000003.2368846916.0000026001D0F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365786087.0000026002408000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002351000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367721039.0000026002412000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364489827.0000026001CE1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369520511.0000026002413000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365987293.0000026001CE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: purchaseorder4.exe, 00000002.00000003.2314754444.00000260022A1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368382323.00000260024C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html
Source: purchaseorder4.exe, 00000002.00000003.2314754444.0000026002241000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2318471205.000002600249B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2382065051.0000026001F90000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2383268785.00000260026A0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2314754444.00000260022A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: purchaseorder4.exe, 00000002.00000002.2385639108.00000260033A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: purchaseorder4.exe, 00000002.00000002.2383616657.0000026002AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: purchaseorder4.exe, 00000002.00000002.2383356804.00000260027A0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2381972173.0000026001E90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: purchaseorder4.exe, 00000002.00000003.2320193569.00000260024BE000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362456773.0000026002565000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370306983.0000026002585000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: purchaseorder4.exe, 00000002.00000003.2364699469.000002607F7ED000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2387352280.000002607F7F8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365004051.000002607F7F0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377833600.000002607F7F6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2375776012.000002607F7F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: purchaseorder4.exe, 00000002.00000002.2383445652.00000260028A0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2381972173.0000026001E90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: purchaseorder4.exe, 00000000.00000003.2286347176.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2394596696.00007FF8B78C1000.00000002.00000001.01000000.00000010.sdmp, purchaseorder4.exe, 00000002.00000002.2392573903.00007FF8B27CE000.00000002.00000001.01000000.0000001F.sdmp, purchaseorder4.exe, 00000002.00000002.2394149892.00007FF8B7841000.00000002.00000001.01000000.00000013.sdmp, purchaseorder4.exe, 00000002.00000002.2393635056.00007FF8B6214000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://github.com/mhammond/pywin32
Source: purchaseorder4.exe, 00000002.00000002.2386458097.0000026003EB4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: purchaseorder4.exe, 00000002.00000003.2378740529.0000026001D45000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361568751.0000026002C53000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373045518.0000026002CC9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369708079.0000026002C9B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372864592.0000026002CB6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362383954.0000026002C53000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364489827.0000026001CE1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377372287.0000026002CCF000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2383445652.00000260028A0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368225233.0000026001D2D000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2383856392.0000026002C53000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365987293.0000026001CE5000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2383163782.0000026002590000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packaging
Source: purchaseorder4.exe, 00000002.00000002.2383163782.0000026002590000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packagingen_py
Source: purchaseorder4.exe, 00000002.00000002.2383268785.00000260026A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: purchaseorder4.exe, 00000002.00000002.2380929512.0000026001B90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: purchaseorder4.exe, 00000002.00000003.2364306036.000002600236C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: purchaseorder4.exe, 00000002.00000002.2387831051.000002607FDE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: purchaseorder4.exe, 00000002.00000003.2375776012.000002607F7F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: purchaseorder4.exe, 00000002.00000003.2364699469.000002607F7ED000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2387352280.000002607F7F8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365004051.000002607F7F0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377833600.000002607F7F6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2375776012.000002607F7F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: purchaseorder4.exe, 00000002.00000003.2364699469.000002607F7ED000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2387352280.000002607F7F8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365004051.000002607F7F0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377833600.000002607F7F6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2375776012.000002607F7F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: purchaseorder4.exe, 00000002.00000002.2383616657.0000026002AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: purchaseorder4.exe, 00000002.00000003.2366859785.0000026001DF4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364867749.0000026001DE9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376285051.0000026001DF5000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362838082.0000026001DCA000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372040103.0000026001DF5000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366243898.0000026001DEE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: purchaseorder4.exe, 00000002.00000002.2385896663.00000260036D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: purchaseorder4.exe, 00000002.00000002.2385896663.00000260036D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920c
Source: purchaseorder4.exe, 00000002.00000003.2375614799.0000026002CC4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365786087.0000026002408000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2384110948.0000026002CC7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2321838846.0000026002CC3000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002351000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369957335.0000026001CB9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369708079.0000026002C9B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372864592.0000026002CB6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370232117.0000026002426000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367721039.0000026002412000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369520511.0000026002413000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367676446.0000026001C94000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369428646.0000026001C9D000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: purchaseorder4.exe, 00000002.00000003.2365786087.0000026002408000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002351000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370232117.0000026002426000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367721039.0000026002412000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369520511.0000026002413000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail/
Source: purchaseorder4.exe, 00000002.00000003.2376194535.0000026001CF9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364489827.0000026001CE1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373747156.0000026001CF8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2374888809.0000026001CF9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365987293.0000026001CE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/
Source: purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/get
Source: purchaseorder4.exe, 00000002.00000003.2369319467.0000026001DC5000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368583100.0000026001DC2000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364596999.0000026001D7F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365077127.0000026001DC0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364489827.0000026001CE1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/post
Source: purchaseorder4.exe, 00000002.00000003.2368382323.00000260024C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: purchaseorder4.exe, 00000002.00000003.2373045518.0000026002CC9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2321838846.0000026002CC3000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369708079.0000026002C9B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372864592.0000026002CB6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377372287.0000026002CCF000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2384164813.0000026002CD2000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mahler:8092/site-updates.py
Source: purchaseorder4.exe, 00000002.00000003.2370415971.0000026001A14000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372583680.0000026001A4F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2375672542.0000026001A56000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2380676163.0000026001A58000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364800314.0000026001A0F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: purchaseorder4.exe, 00000002.00000003.2365786087.00000260024A9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368875159.00000260024AA000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.00000260024A9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.00000260024A9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2382975884.00000260024AB000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2375836031.00000260024AB000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.00000260024A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: purchaseorder4.exe, 00000002.00000002.2383445652.00000260028A0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2383268785.00000260026A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: purchaseorder4.exe, 00000002.00000002.2391270361.00007FF8A8E1F000.00000002.00000001.01000000.00000005.sdmp String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: purchaseorder4.exe, 00000002.00000002.2383356804.00000260027A0000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2381972173.0000026001E90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: purchaseorder4.exe, 00000002.00000003.2369319467.0000026001DC5000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368583100.0000026001DC2000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2386004860.0000026003810000.00000004.00001000.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364596999.0000026001D7F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365077127.0000026001DC0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364489827.0000026001CE1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://requests.readthedocs.io
Source: purchaseorder4.exe, 00000002.00000002.2383700298.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363391268.0000026002BBC000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365615919.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369892028.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363847601.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362795977.0000026002BA1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366063143.0000026002BB4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363178642.0000026002BB0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362323038.0000026002D00000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376124949.0000026002D04000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376606966.0000026002D24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: purchaseorder4.exe, 00000002.00000003.2313024105.0000026001DD1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369319467.0000026001DEA000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368541395.0000026001DEA000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364867749.0000026001DE9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362838082.0000026001DCA000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2312072659.0000026001DC9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2311329097.0000026001DD1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372356212.0000026001DEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: purchaseorder4.exe, 00000002.00000002.2383445652.00000260028A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2
Source: purchaseorder4.exe, 00000002.00000002.2383445652.00000260028A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2P
Source: purchaseorder4.exe, 00000002.00000003.2314754444.0000026002241000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365095310.00000260019A3000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365786087.0000026002408000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.00000260024A9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367385651.0000026001E6C000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002351000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.00000260024BE000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370624164.0000026001E81000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363477134.00000260024AD000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2318471205.000002600249B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370561505.0000026001E7E000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367721039.0000026002412000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366570656.00000260024C6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369520511.0000026002413000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362838082.0000026001E6A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364867749.0000026001E6A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369070072.0000026001E75000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366044375.0000026001A09000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365517528.0000026001E6A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: purchaseorder4.exe, 00000002.00000003.2370773485.0000026001E82000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367385651.0000026001E6C000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370624164.0000026001E81000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370561505.0000026001E7E000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362838082.0000026001E6A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364867749.0000026001E6A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369070072.0000026001E75000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365517528.0000026001E6A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: purchaseorder4.exe, 00000002.00000003.2362913745.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373172224.00000260021F8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365786087.000002600247A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366999934.000002600247D000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.000002600247A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373921602.000002600247F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.000002600247A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: purchaseorder4.exe, 00000002.00000003.2362913745.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.00000260021D1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373172224.00000260021F8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2376930091.00000260021E5000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370892205.00000260021F7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362913745.00000260021CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: purchaseorder4.exe, 00000002.00000003.2375614799.0000026002CC4000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2384110948.0000026002CC7000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2321838846.0000026002CC3000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369957335.0000026001CB9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369708079.0000026002C9B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372864592.0000026002CB6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367676446.0000026001C94000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369428646.0000026001C9D000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: purchaseorder4.exe, 00000002.00000002.2382065051.0000026001F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://upload.pypi.org/legacy/
Source: purchaseorder4.exe, 00000002.00000002.2385639108.00000260033A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: purchaseorder4.exe, 00000002.00000002.2385813257.00000260035C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: purchaseorder4.exe, 00000002.00000002.2385813257.00000260035C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings0
Source: purchaseorder4.exe, 00000002.00000003.2365205932.000002607F803000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364699469.000002607F7ED000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365004051.000002607F7F0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368295742.000002607F817000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2366482138.000002607F815000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365138324.000002607F801000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: purchaseorder4.exe, 00000002.00000003.2373782096.0000026002D59000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2373616727.0000026002D51000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361673045.0000026002D4A000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2384596162.0000026002DB8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: purchaseorder4.exe, 00000002.00000002.2390496248.00007FF8A8609000.00000002.00000001.01000000.00000015.sdmp, purchaseorder4.exe, 00000002.00000002.2390863465.00007FF8A8ADB000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.openssl.org/H
Source: purchaseorder4.exe, 00000002.00000003.2369319467.0000026001DC5000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2368583100.0000026001DC2000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364596999.0000026001D7F000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2365077127.0000026001DC0000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364489827.0000026001CE1000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.python.org
Source: purchaseorder4.exe, 00000002.00000003.2373045518.0000026002CC9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2321838846.0000026002CC3000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369708079.0000026002C9B000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2372864592.0000026002CB6000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2377372287.0000026002CCF000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2384164813.0000026002CD2000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2361778148.0000026002C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/
Source: purchaseorder4.exe, 00000002.00000002.2380929512.0000026001B90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: purchaseorder4.exe, 00000002.00000002.2387831051.000002607FDE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: purchaseorder4.exe, 00000002.00000003.2365786087.0000026002408000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2362516738.0000026002389000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2320193569.0000026002351000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2370232117.0000026002426000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364056719.0000026002398000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2367721039.0000026002412000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369520511.0000026002413000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: purchaseorder4.exe
Detected potential crypto function
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781727A9C 0_2_00007FF781727A9C
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781707B60 0_2_00007FF781707B60
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781726B50 0_2_00007FF781726B50
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781718670 0_2_00007FF781718670
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781701000 0_2_00007FF781701000
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF7817092D0 0_2_00007FF7817092D0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF7817142D4 0_2_00007FF7817142D4
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781724A60 0_2_00007FF781724A60
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781712274 0_2_00007FF781712274
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781721720 0_2_00007FF781721720
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781712A94 0_2_00007FF781712A94
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78171ECA0 0_2_00007FF78171ECA0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF7817184BC 0_2_00007FF7817184BC
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78171AC50 0_2_00007FF78171AC50
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781712480 0_2_00007FF781712480
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78171F320 0_2_00007FF78171F320
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF7817226C4 0_2_00007FF7817226C4
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781713ED0 0_2_00007FF781713ED0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781718EF4 0_2_00007FF781718EF4
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781724EFC 0_2_00007FF781724EFC
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781712684 0_2_00007FF781712684
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781709D9B 0_2_00007FF781709D9B
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781726DCC 0_2_00007FF781726DCC
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781713540 0_2_00007FF781713540
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781727550 0_2_00007FF781727550
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781712070 0_2_00007FF781712070
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781712890 0_2_00007FF781712890
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781718670 0_2_00007FF781718670
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78172A7D8 0_2_00007FF78172A7D8
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78171E80C 0_2_00007FF78171E80C
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781721720 0_2_00007FF781721720
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781709F3B 0_2_00007FF781709F3B
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781716750 0_2_00007FF781716750
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78170A76D 0_2_00007FF78170A76D
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A802EB60 2_2_00007FF8A802EB60
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80A1F40 2_2_00007FF8A80A1F40
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8040090 2_2_00007FF8A8040090
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8080210 2_2_00007FF8A8080210
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A803B970 2_2_00007FF8A803B970
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80419E0 2_2_00007FF8A80419E0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8084A10 2_2_00007FF8A8084A10
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8054A30 2_2_00007FF8A8054A30
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80E1A40 2_2_00007FF8A80E1A40
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A806EA70 2_2_00007FF8A806EA70
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A802FA90 2_2_00007FF8A802FA90
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A803AAC0 2_2_00007FF8A803AAC0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8026B31 2_2_00007FF8A8026B31
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8036B70 2_2_00007FF8A8036B70
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8028C90 2_2_00007FF8A8028C90
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A807DC90 2_2_00007FF8A807DC90
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A807BCF0 2_2_00007FF8A807BCF0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8023D60 2_2_00007FF8A8023D60
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8078D60 2_2_00007FF8A8078D60
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8065DA0 2_2_00007FF8A8065DA0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A805BDD6 2_2_00007FF8A805BDD6
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8044DF0 2_2_00007FF8A8044DF0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A804AE10 2_2_00007FF8A804AE10
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8045E00 2_2_00007FF8A8045E00
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A804CE00 2_2_00007FF8A804CE00
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A804EE30 2_2_00007FF8A804EE30
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80C2E60 2_2_00007FF8A80C2E60
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80A6EA0 2_2_00007FF8A80A6EA0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8031EC0 2_2_00007FF8A8031EC0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8062F20 2_2_00007FF8A8062F20
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8094F70 2_2_00007FF8A8094F70
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A804BFC0 2_2_00007FF8A804BFC0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80A7FF0 2_2_00007FF8A80A7FF0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8059080 2_2_00007FF8A8059080
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A806D0B0 2_2_00007FF8A806D0B0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80890F0 2_2_00007FF8A80890F0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80350F0 2_2_00007FF8A80350F0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80261C0 2_2_00007FF8A80261C0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8029270 2_2_00007FF8A8029270
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80D0290 2_2_00007FF8A80D0290
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80822A0 2_2_00007FF8A80822A0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A803B310 2_2_00007FF8A803B310
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8052370 2_2_00007FF8A8052370
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80793A0 2_2_00007FF8A80793A0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A807A420 2_2_00007FF8A807A420
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A808E450 2_2_00007FF8A808E450
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8023440 2_2_00007FF8A8023440
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80B54B0 2_2_00007FF8A80B54B0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80904F0 2_2_00007FF8A80904F0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8092520 2_2_00007FF8A8092520
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A802254A 2_2_00007FF8A802254A
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A802E5A0 2_2_00007FF8A802E5A0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A805B5DC 2_2_00007FF8A805B5DC
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8038670 2_2_00007FF8A8038670
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80D26B0 2_2_00007FF8A80D26B0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80476B0 2_2_00007FF8A80476B0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8068710 2_2_00007FF8A8068710
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A808F750 2_2_00007FF8A808F750
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8026743 2_2_00007FF8A8026743
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80BA7D0 2_2_00007FF8A80BA7D0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80A87F0 2_2_00007FF8A80A87F0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A804B7F0 2_2_00007FF8A804B7F0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A802A830 2_2_00007FF8A802A830
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80A9820 2_2_00007FF8A80A9820
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8042840 2_2_00007FF8A8042840
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80B58A0 2_2_00007FF8A80B58A0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A80238A0 2_2_00007FF8A80238A0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A81A1860 2_2_00007FF8A81A1860
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C5DA3 2_2_00007FF8A82C5DA3
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C53AD 2_2_00007FF8A82C53AD
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A847A900 2_2_00007FF8A847A900
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C23F6 2_2_00007FF8A82C23F6
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C5F10 2_2_00007FF8A82C5F10
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C4D09 2_2_00007FF8A82C4D09
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C3A94 2_2_00007FF8A82C3A94
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8402C00 2_2_00007FF8A8402C00
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C1B27 2_2_00007FF8A82C1B27
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A83A2CD0 2_2_00007FF8A83A2CD0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C54CF 2_2_00007FF8A82C54CF
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C15C8 2_2_00007FF8A82C15C8
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C1299 2_2_00007FF8A82C1299
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C6564 2_2_00007FF8A82C6564
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C5434 2_2_00007FF8A82C5434
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C213A 2_2_00007FF8A82C213A
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C53C6 2_2_00007FF8A82C53C6
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C4F43 2_2_00007FF8A82C4F43
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82DEF00 2_2_00007FF8A82DEF00
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C2171 2_2_00007FF8A82C2171
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C638E 2_2_00007FF8A82C638E
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8463010 2_2_00007FF8A8463010
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82DF060 2_2_00007FF8A82DF060
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A847B0E0 2_2_00007FF8A847B0E0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A8476100 2_2_00007FF8A8476100
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C6D5C 2_2_00007FF8A82C6D5C
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C26EE 2_2_00007FF8A82C26EE
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C2301 2_2_00007FF8A82C2301
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C1A50 2_2_00007FF8A82C1A50
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C3634 2_2_00007FF8A82C3634
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C6EBF 2_2_00007FF8A82C6EBF
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C1217 2_2_00007FF8A82C1217
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: String function: 00007FF8A82C2A09 appears 60 times
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: String function: 00007FF8A80289A0 appears 31 times
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: String function: 00007FF8A82C1EF6 appears 377 times
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: String function: 00007FF8A82C4840 appears 33 times
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: String function: 00007FF8A82C405C appears 146 times
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: String function: 00007FF8A8028B90 appears 124 times
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: String function: 00007FF781702B10 appears 47 times
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: String function: 00007FF8A8029AD0 appears 169 times
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: String function: 00007FF8A82C2739 appears 122 times
PE file contains executable resources (Code or Archives)
Source: ucrtbase.dll.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file does not import any functions
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-path-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: python3.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: purchaseorder4.exe, 00000000.00000003.2286728644.000001F981848000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000000.00000003.2286347176.000001F981848000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewin32ui.pyd0 vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000000.00000003.2286951405.000001F981848000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000000.00000003.2287588502.000001F981848000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_asyncio.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe Binary or memory string: OriginalFilename vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2396658543.00007FF8B8F76000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2390496248.00007FF8A8609000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2390863465.00007FF8A8ADB000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: OriginalFilenamelibsslH vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2397363813.00007FF8B93D2000.00000002.00000001.01000000.0000000A.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2397801698.00007FF8B9F7D000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2394596696.00007FF8B78C1000.00000002.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilenamepywintypes310.dll0 vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2392573903.00007FF8B27CE000.00000002.00000001.01000000.0000001F.sdmp Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2395231987.00007FF8B8107000.00000002.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2393884714.00007FF8B7815000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2396207483.00007FF8B8AFA000.00000002.00000001.01000000.00000018.sdmp Binary or memory string: OriginalFilename_overlapped.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2392979725.00007FF8B6036000.00000002.00000001.01000000.0000001D.sdmp Binary or memory string: OriginalFilename_sqlite3.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2394149892.00007FF8B7841000.00000002.00000001.01000000.00000013.sdmp Binary or memory string: OriginalFilenamewin32api.pyd0 vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2398222416.00007FF8BFAD7000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2394927686.00007FF8B800D000.00000002.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilenamepyexpat.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2393215592.00007FF8B604E000.00000002.00000001.01000000.00000019.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2396848915.00007FF8B8F92000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2393635056.00007FF8B6214000.00000002.00000001.01000000.00000012.sdmp Binary or memory string: OriginalFilenamepythoncom310.dll0 vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2397131913.00007FF8B9104000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2395755927.00007FF8B825E000.00000002.00000001.01000000.00000017.sdmp Binary or memory string: OriginalFilename_asyncio.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2389428930.00007FF8A8183000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: OriginalFilenamesqlite3.dll0 vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2396417159.00007FF8B8CB9000.00000002.00000001.01000000.00000011.sdmp Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2391959123.00007FF8A8F28000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamepython310.dll. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2389742802.00007FF8A82B1000.00000002.00000001.01000000.0000001C.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2397564631.00007FF8B9846000.00000002.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2387746863.000002607FD20000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs purchaseorder4.exe
Source: purchaseorder4.exe, 00000002.00000002.2387069015.000002607F770000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: windir=C:\WindowsXE;.BAT;.CMD;.VBp
Source: classification engine Classification label: mal72.troj.spyw.winEXE@6/141@1/1
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781708770 GetLastError,FormatMessageW,WideCharToMultiByte, 0_2_00007FF781708770
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4368:120:WilError_03
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602 Jump to behavior
Source: purchaseorder4.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\purchaseorder4.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: purchaseorder4.exe, 00000002.00000002.2389356129.00007FF8A8151000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: purchaseorder4.exe, 00000002.00000002.2389356129.00007FF8A8151000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: purchaseorder4.exe, 00000002.00000002.2389356129.00007FF8A8151000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: purchaseorder4.exe, 00000002.00000002.2389356129.00007FF8A8151000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: purchaseorder4.exe, purchaseorder4.exe, 00000002.00000002.2389356129.00007FF8A8151000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: purchaseorder4.exe, 00000002.00000002.2389356129.00007FF8A8151000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: purchaseorder4.exe, 00000002.00000002.2389356129.00007FF8A8151000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: C:\Users\user\Desktop\purchaseorder4.exe File read: C:\Users\user\Desktop\purchaseorder4.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\purchaseorder4.exe "C:\Users\user\Desktop\purchaseorder4.exe"
Source: C:\Users\user\Desktop\purchaseorder4.exe Process created: C:\Users\user\Desktop\purchaseorder4.exe "C:\Users\user\Desktop\purchaseorder4.exe"
Source: C:\Users\user\Desktop\purchaseorder4.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\purchaseorder4.exe Process created: C:\Users\user\Desktop\purchaseorder4.exe "C:\Users\user\Desktop\purchaseorder4.exe" Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: libffi-7.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: sqlite3.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\Desktop\pyvenv.cfg Jump to behavior
Source: purchaseorder4.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: purchaseorder4.exe Static file information: File size 18813776 > 1048576
Source: purchaseorder4.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: purchaseorder4.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: purchaseorder4.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: purchaseorder4.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: purchaseorder4.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: purchaseorder4.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: purchaseorder4.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: purchaseorder4.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: purchaseorder4.exe, 00000002.00000002.2393327241.00007FF8B61CC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: purchaseorder4.exe, 00000002.00000002.2389528884.00007FF8A82AC000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: ucrtbase.pdb source: purchaseorder4.exe, 00000002.00000002.2395097234.00007FF8B80CC000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: purchaseorder4.exe, 00000002.00000002.2396996550.00007FF8B90FB000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: tRSA_PRIME_INFOeqdmp1dmq1iqmpprime_infosRSAPrivateKeyRSAPublicKeyhashAlgorithmmaskGenAlgorithmsaltLengthtrailerFieldRSA_PSS_PARAMShashFuncmaskGenFuncpSourceFuncRSA_OAEP_PARAMScompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 23 00:13:44 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: purchaseorder4.exe, 00000002.00000002.2390759212.00007FF8A8AA6000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: purchaseorder4.exe, 00000000.00000003.2286951405.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2396332002.00007FF8B8CB5000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdb source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: purchaseorder4.exe, 00000002.00000002.2393327241.00007FF8B61CC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: purchaseorder4.exe, 00000002.00000002.2390218021.00007FF8A8510000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdbo source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: purchaseorder4.exe, 00000002.00000002.2389356129.00007FF8A8151000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: purchaseorder4.exe, 00000002.00000002.2394435263.00007FF8B78B0000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: purchaseorder4.exe, 00000002.00000002.2390218021.00007FF8A8592000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: purchaseorder4.exe, 00000002.00000002.2390759212.00007FF8A8AA6000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: purchaseorder4.exe, 00000002.00000002.2390218021.00007FF8A8510000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: purchaseorder4.exe, 00000000.00000003.2286728644.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2398128067.00007FF8BFAD1000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: purchaseorder4.exe, 00000002.00000002.2397697062.00007FF8B9F70000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: purchaseorder4.exe, 00000002.00000002.2393143390.00007FF8B6046000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: crypto\engine\tb_digest.cENGINE_get_digestcrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancrypto\packet.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: purchaseorder4.exe, 00000002.00000002.2388918381.00007FF8A7E68000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: purchaseorder4.exe, 00000002.00000002.2394002737.00007FF8B7833000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: purchaseorder4.exe, 00000000.00000003.2287077073.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2395553131.00007FF8B8257000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: purchaseorder4.exe, 00000002.00000002.2394002737.00007FF8B7833000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: purchaseorder4.exe, 00000002.00000002.2391270361.00007FF8A8E1F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: purchaseorder4.exe, 00000002.00000002.2394839291.00007FF8B8002000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: purchaseorder4.exe, 00000002.00000002.2396567848.00007FF8B8F73000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: purchaseorder4.exe, 00000002.00000002.2396996550.00007FF8B90FB000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: purchaseorder4.exe, 00000000.00000003.2287206065.000001F981848000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000002.2397257835.00007FF8B93CD000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: purchaseorder4.exe, 00000002.00000002.2394435263.00007FF8B78B0000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: ucrtbase.pdbUGP source: purchaseorder4.exe, 00000002.00000002.2395097234.00007FF8B80CC000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: purchaseorder4.exe, 00000002.00000002.2396757605.00007FF8B8F88000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: purchaseorder4.exe, 00000002.00000002.2387746863.000002607FD20000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: purchaseorder4.exe, 00000002.00000002.2393722010.00007FF8B77FD000.00000002.00000001.01000000.00000014.sdmp
Source: purchaseorder4.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: purchaseorder4.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: purchaseorder4.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: purchaseorder4.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: purchaseorder4.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
PE file contains sections with non-standard names
Source: purchaseorder4.exe Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: python310.dll.0.dr Static PE information: section name: PyRuntim
Source: mfc140u.dll.0.dr Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: _RDATA

Persistence and Installation Behavior
barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\purchaseorder4.exe Process created: "C:\Users\user\Desktop\purchaseorder4.exe"
Drops PE files
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\win32crypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin\win32ui.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\sqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_pkcs1_decode.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\win32com\shell\shell.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA224.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32\pywintypes310.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\VCRUNTIME140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_RIPEMD160.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_chacha20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_MD4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_poly1305.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA512.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_blowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA384.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\PublicKey\_ec_ws.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\charset_normalizer\md__mypyc.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\charset_normalizer\md.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_MD2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\PublicKey\_x25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\PublicKey\_ed25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32\pythoncom310.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_BLAKE2b.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_des3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-path-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\libffi-7.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\PublicKey\_ed448.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\VCRUNTIME140.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Math\_modexp.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_des.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_ARC4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_keccak.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\win32evtlog.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_cast.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_arc2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\_cffi_backend.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\_MEI30602\python310.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: adobe 12.png
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF7817053F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00007FF7817053F0
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\win32crypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin\win32ui.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_pkcs1_decode.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\win32com\shell\shell.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA224.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32\pywintypes310.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_RIPEMD160.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_chacha20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_MD4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_poly1305.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA512.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_blowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\PublicKey\_ec_ws.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_SHA384.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\charset_normalizer\md__mypyc.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\charset_normalizer\md.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_MD2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\PublicKey\_x25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\PublicKey\_ed25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_BLAKE2b.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32\pythoncom310.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_des3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-path-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\PublicKey\_ed448.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Math\_modexp.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_des.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_ARC4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash\_keccak.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\win32evtlog.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_cast.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher\_raw_arc2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\_cffi_backend.cp310-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\purchaseorder4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI30602\python310.dll Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\purchaseorder4.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\purchaseorder4.exe API coverage: 2.1 %
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781708D00 FindFirstFileExW,FindClose, 0_2_00007FF781708D00
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781718670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF781718670
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF7817226C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF7817226C4
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781718670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF781718670
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A802FEB0 GetSystemInfo, 2_2_00007FF8A802FEB0
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-datetime-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-console-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602 Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI30602\pythonwin Jump to behavior
Source: purchaseorder4.exe, 00000002.00000003.2311109674.0000026001CD8000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2369957335.0000026001CCC000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2311526856.0000026001CCE000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2379737936.0000026001CD9000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2363242195.0000026001C91000.00000004.00000020.00020000.00000000.sdmp, purchaseorder4.exe, 00000002.00000003.2364762480.0000026001CCA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78171B3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF78171B3CC
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF7817242D0 GetProcessHeap, 0_2_00007FF7817242D0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78170CA9C SetUnhandledExceptionFilter, 0_2_00007FF78170CA9C
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78171B3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF78171B3CC
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78170C8BC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF78170C8BC
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78170C030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF78170C030
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A814F0C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF8A814F0C0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A81A2A60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF8A81A2A60
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A81A3028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF8A81A3028
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\purchaseorder4.exe Process created: C:\Users\user\Desktop\purchaseorder4.exe "C:\Users\user\Desktop\purchaseorder4.exe" Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78172A620 cpuid 0_2_00007FF78172A620
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Cipher VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Hash VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\PublicKey VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Crypto\Util VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\ucrtbase.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\_ctypes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\_bz2.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\_lzma.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-console-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-datetime-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-debug-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-errorhandling-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l1-2-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l2-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-heap-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-interlocked-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-memory-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-path-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-processthreads-l1-1-1.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-string-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\api-ms-win-core-util-l1-1-0.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\_socket.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\select.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pyexpat.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\_queue.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32\pywintypes310.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\pywin32_system32\pythoncom310.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32\win32api.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32com VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32com VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32com VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI30602\_ssl.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Queries volume information: C:\Users\user\Desktop\purchaseorder4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF78170C7A0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF78170C7A0
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 0_2_00007FF781726B50 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 0_2_00007FF781726B50
Source: C:\Users\user\Desktop\purchaseorder4.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Detected generic credential text file
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\google-chrome\Download_History.txt Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\microsoft-edge\Autofill_Data.txt Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\microsoft-edge\Browser_History.txt Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\microsoft-edge\Download_History.txt Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\google-chrome\Saved_Passwords.txt Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\google-chrome\Browser_History.txt Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\microsoft-edge\Saved_Credit_Cards.txt Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\google-chrome\Saved_Credit_Cards.txt Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\google-chrome\Autofill_Data.txt Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File created: C:\Users\user\AppData\Local\Temp\Browser\microsoft-edge\Saved_Passwords.txt Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\purchaseorder4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Yara detected Generic Python Stealer
Source: Yara match File source: Process Memory Space: purchaseorder4.exe PID: 3224, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Generic Python Stealer
Source: Yara match File source: Process Memory Space: purchaseorder4.exe PID: 3224, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\purchaseorder4.exe Code function: 2_2_00007FF8A82C2B62 bind,WSAGetLastError, 2_2_00007FF8A82C2B62
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1428748 Sample: purchaseorder4.exe Startdate: 19/04/2024 Architecture: WINDOWS Score: 72 29 mail.dasmake.xyz 2->29 31 dasmake.xyz 2->31 35 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->35 37 Initial sample is a PE file and has a suspicious name 2->37 39 Yara detected Generic Python Stealer 2->39 9 purchaseorder4.exe 159 2->9         started        signatures3 41 Performs DNS queries to domains with low reputation 29->41 process4 file5 21 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 9->21 dropped 23 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 9->23 dropped 25 C:\Users\user\AppData\...\win32evtlog.pyd, PE32+ 9->25 dropped 27 116 other files (none is malicious) 9->27 dropped 43 Found pyInstaller with non standard icon 9->43 13 purchaseorder4.exe 23 9->13         started        signatures6 process7 dnsIp8 33 dasmake.xyz 192.236.232.35, 49726, 587 HOSTWINDSUS United States 13->33 45 Tries to harvest and steal browser information (history, passwords, etc) 13->45 47 Detected generic credential text file 13->47 17 cmd.exe 1 13->17         started        signatures9 process10 process11 19 conhost.exe 17->19         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.236.232.35
 dasmake.xyz United States
54290 HOSTWINDSUS true

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
fp2e7a.wpc.phicdn.net 192.229.211.108 true
dasmake.xyz 192.236.232.35 true
mail.dasmake.xyz unknown unknown