Edit tour

Windows Analysis Report
yM5WEfAX4h.exe

Overview

General Information

Sample name:	yM5WEfAX4h.exe renamed because original name is a hash value
Original sample name:	893504e2ea6080cb25c20223c383d455.exe
Analysis ID:	1632099
MD5:	893504e2ea6080cb25c20223c383d455
SHA1:	fb372aa27c01174b299e3ebe228cca466a249c13
SHA256:	4fe5ace5786596ba98e782ef468a908428482188b68c31c006eb68a7d9acf527
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Found many strings related to Crypto-Wallets (likely being stolen)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

yM5WEfAX4h.exe (PID: 6988 cmdline: "C:\Users\user\Desktop\yM5WEfAX4h.exe" MD5: 893504E2EA6080CB25C20223C383D455)

yM5WEfAX4h.exe (PID: 7084 cmdline: "C:\Users\user\Desktop\yM5WEfAX4h.exe" MD5: 893504E2EA6080CB25C20223C383D455)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yM5WEfAX4h.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: yM5WEfAX4h.exe	Virustotal: Detection: 52%			Perma Link
Source: yM5WEfAX4h.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21D43A90 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	1_2_00007FFA21D43A90
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21CE103C CRYPTO_malloc,COMP_expand_block,	1_2_00007FFA21CE103C
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21CE108C ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFA21CE108C
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21D435D0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	1_2_00007FFA21D435D0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21CE1023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	1_2_00007FFA21CE1023
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21CE1113 EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	1_2_00007FFA21CE1113
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21CE105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	1_2_00007FFA21CE105F
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21CE1087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	1_2_00007FFA21CE1087
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21CE107D CRYPTO_free,	1_2_00007FFA21CE107D
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21D443A0 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	1_2_00007FFA21D443A0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21D44780 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	1_2_00007FFA21D44780
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21CE1122 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memmove,CRYPTO_malloc,memmove,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memmove,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	1_2_00007FFA21CE1122
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA21D43F10 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	1_2_00007FFA21D43F10

Source: yM5WEfAX4h.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: ucrtbase.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2168439649.00007FFA21E74000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: yM5WEfAX4h.exe, 00000001.00000002.2166132319.00007FFA21252000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.992608005.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.909800565.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2176325419.00007FFA33D81000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: yM5WEfAX4h.exe, 00000001.00000002.2169985248.00007FFA2F381000.00000002.00000001.01000000.0000001D.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb!! source: yM5WEfAX4h.exe, 00000001.00000002.2170505758.00007FFA2FD42000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: yM5WEfAX4h.exe, 00000000.00000003.909961307.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2174142673.00007FFA322B5000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.991920612.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2175774858.00007FFA32D11000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2173549364.00007FFA32177000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2173276678.00007FFA31E82000.00000002.00000001.01000000.00000011.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.984182097.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2175032140.00007FFA3285C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2175323228.00007FFA32B0D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.990358383.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: yM5WEfAX4h.exe, 00000001.00000002.2168439649.00007FFA21E74000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2174578875.00007FFA32479000.00000002.00000001.01000000.0000000C.sdmp, _socket.pyd.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.992608005.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.909961307.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2174142673.00007FFA322B5000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.991920612.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2166908074.00007FFA217B4000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2163573196.00007FFA20E9F000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_elementtree.pdb source: yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: yM5WEfAX4h.exe, 00000001.00000002.2166132319.00007FFA21252000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.990358383.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2170505758.00007FFA2FD42000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.984182097.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: yM5WEfAX4h.exe, 00000000.00000003.909800565.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2176325419.00007FFA33D81000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2163000232.00007FFA20D4E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2169985248.00007FFA2F381000.00000002.00000001.01000000.0000001D.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.989453335.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2176056390.00007FFA32D53000.00000002.00000001.01000000.0000000D.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: yM5WEfAX4h.exe, 00000001.00000002.2168144250.00007FFA21D65000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2175032140.00007FFA3285C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.989453335.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2174780715.00007FFA32653000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2175584468.00007FFA32B54000.00000002.00000001.01000000.00000010.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: yM5WEfAX4h.exe, 00000001.00000002.2175584468.00007FFA32B54000.00000002.00000001.01000000.00000010.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2171898659.00007FFA3173F000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2150989151.000001B54C400000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2168144250.00007FFA21D65000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2172623573.00007FFA317ED000.00000002.00000001.01000000.00000013.sdmp, _ssl.pyd.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366492F0 FindFirstFileExW,FindClose,	0_2_00007FF6366492F0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366483B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6366483B0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636661BD4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF636661BD4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF6366492F0 FindFirstFileExW,FindClose,	1_2_00007FF6366492F0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF6366483B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6366483B0

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: _imagingft.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://.css
Source: _imagingft.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://.jpg
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://193.164.4.175/7008248899_chat.txt
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://193.164.4.175/7008248899_token.txt
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://193.164.4.175/7008248899_token.txtd_field
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F2B5000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F37E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001509645.000001CA95A25000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912810553.000001CA95A0E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001509645.000001CA95A25000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.cou
Source: yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E238000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E6D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: yM5WEfAX4h.exe, 00000001.00000003.1012628589.000001B54E7CB000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2151358296.000001B54C4C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: yM5WEfAX4h.exe, 00000001.00000002.2151358296.000001B54C4C5000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E8B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: yM5WEfAX4h.exe, 00000001.00000002.2151358296.000001B54C4C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlDa
Source: yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl(SF
Source: yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crld
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crlxception
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001509645.000001CA95A25000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912810553.000001CA95A0E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912810553.000001CA95A0E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: pyexpat.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912810553.000001CA95A0E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F2B5000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F37E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: yM5WEfAX4h.exe, 00000001.00000002.2157964007.000001B54FB20000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E889000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157776705.000001B54F9E0000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E238000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157964007.000001B54FB40000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: yM5WEfAX4h.exe, 00000001.00000003.1012780071.000001B54E7B5000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2155937893.000001B54EB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: yM5WEfAX4h.exe, 00000001.00000002.2155937893.000001B54EB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: yM5WEfAX4h.exe, 00000001.00000002.2155937893.000001B54EB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E6D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: yM5WEfAX4h.exe, 00000001.00000003.1014971832.000001B54E8B8000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E8B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: _imagingft.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912810553.000001CA95A0E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001509645.000001CA95A25000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001509645.000001CA95A25000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: yM5WEfAX4h.exe, 00000001.00000002.2155671273.000001B54EA60000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2155937893.000001B54EB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: yM5WEfAX4h.exe, 00000000.00000003.978577159.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tango.freedesktop.org/Tango_Desktop_Project
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F2B5000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F37E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-76
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: yM5WEfAX4h.exe, 00000001.00000002.2157964007.000001B54FBD0000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157964007.000001B54FB2C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5234
Source: yM5WEfAX4h.exe, 00000001.00000002.2157964007.000001B54FB40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F3B6000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F37E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: yM5WEfAX4h.exe, 00000001.00000002.2157964007.000001B54FBD0000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157964007.000001B54FB2C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6455#section-5.2
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlW(
Source: yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153090929.000001B54E047000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: yM5WEfAX4h.exe, 00000001.00000002.2155671273.000001B54EA60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912810553.000001CA95A0E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: yM5WEfAX4h.exe, 00000001.00000002.2157159833.000001B54F204000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2155606654.000001B54EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: yM5WEfAX4h.exe, 00000001.00000003.1014549740.000001B54E84A000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E9CE000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1015316880.000001B54E9CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/servers
Source: yM5WEfAX4h.exe, 00000001.00000002.2157776705.000001B54F9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: yM5WEfAX4h.exe, 00000001.00000002.2158269686.000001B54FCE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: yM5WEfAX4h.exe, 00000001.00000002.2156300854.000001B54EDA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: yM5WEfAX4h.exe, 00000001.00000002.2157776705.000001B54F9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://code.activestate.com/recipes/578019-bytes-to-human-human-to-bytes-converter/?in=user-4178764
Source: yM5WEfAX4h.exe, 00000000.00000003.978577159.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by-sa/3.0/)
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v10/users/
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: yM5WEfAX4h.exe, 00000001.00000002.2153090929.000001B54E047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: yM5WEfAX4h.exe, 00000001.00000002.2152115402.000001B54DCD0000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2152115402.000001B54DD4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2152115402.000001B54DD4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2152115402.000001B54DD4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2152115402.000001B54DD4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2152653399.000001B54DF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2152653399.000001B54DF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2152115402.000001B54DD4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: yM5WEfAX4h.exe, 00000001.00000002.2153090929.000001B54E010000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006461205.000001B54E02B000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006436292.000001B54E026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: yM5WEfAX4h.exe, 00000001.00000003.1011211319.000001B54E3F2000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011519225.000001B54E3F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: yM5WEfAX4h.exe, 00000001.00000002.2155937893.000001B54EB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1015316880.000001B54E943000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014971832.000001B54E931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: yM5WEfAX4h.exe, 00000001.00000002.2153090929.000001B54E010000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006461205.000001B54E02B000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006436292.000001B54E026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/astral-sh/ruff
Source: yM5WEfAX4h.exe, 00000001.00000002.2157776705.000001B54F9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: yM5WEfAX4h.exe, 00000001.00000002.2157776705.000001B54F9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55y
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: yM5WEfAX4h.exe, 00000001.00000002.2155937893.000001B54EB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2170064465.00007FFA2F392000.00000002.00000001.01000000.0000001D.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2170584726.00007FFA2FD4F000.00000002.00000001.01000000.0000001C.sdmp, pywintypes312.dll.0.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: yM5WEfAX4h.exe, 00000001.00000002.2156300854.000001B54EDA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: yM5WEfAX4h.exe, 00000001.00000002.2155937893.000001B54EB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: yM5WEfAX4h.exe, 00000001.00000002.2156300854.000001B54EDA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: yM5WEfAX4h.exe, 00000001.00000002.2154467597.000001B54E540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: yM5WEfAX4h.exe, 00000001.00000002.2154467597.000001B54E540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pypa/wheel
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pypa/wheel/issues
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2152115402.000001B54DD4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: yM5WEfAX4h.exe, 00000001.00000003.1006436292.000001B54E026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: yM5WEfAX4h.exe, 00000001.00000002.2153090929.000001B54E010000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006461205.000001B54E02B000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006436292.000001B54E026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: yM5WEfAX4h.exe, 00000001.00000003.1011211319.000001B54E3F2000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1010618473.000001B54E3E1000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011519225.000001B54E3F2000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E238000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1010463039.000001B54E3CF000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1010463039.000001B54E37A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: yM5WEfAX4h.exe, 00000001.00000002.2153090929.000001B54E010000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006252061.000001B54E031000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006278324.000001B54E025000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006461205.000001B54E02B000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1006436292.000001B54E026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: yM5WEfAX4h.exe, 00000001.00000003.1014971832.000001B54E931000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014549740.000001B54E84A000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153090929.000001B54E047000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E6D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: yM5WEfAX4h.exe, 00000001.00000003.1015316880.000001B54E943000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014971832.000001B54E931000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014549740.000001B54E84A000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E6D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: yM5WEfAX4h.exe, 00000001.00000003.1014971832.000001B54E8B8000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E8B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: yM5WEfAX4h.exe, 00000001.00000002.2153090929.000001B54E047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E8B8000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: METADATA0.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: yM5WEfAX4h.exe, 00000001.00000002.2155671273.000001B54EA60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E8B8000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: yM5WEfAX4h.exe, 00000000.00000003.979555569.000001CA95A04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://linuxreviews.org/HOWTO_change_the_mouse_speed_in_X
Source: yM5WEfAX4h.exe, 00000001.00000003.1012628589.000001B54E84A000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1012628589.000001B54E7CB000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014549740.000001B54E84A000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F37E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: yM5WEfAX4h.exe, 00000001.00000002.2156300854.000001B54EDA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/).
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/All
Source: yM5WEfAX4h.exe, 00000001.00000003.1015480129.000001B54E7FB000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: yM5WEfAX4h.exe, 00000001.00000002.2154467597.000001B54E540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: yM5WEfAX4h.exe, 00000001.00000002.2166908074.00007FFA217B4000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: yM5WEfAX4h.exe, 00000001.00000002.2157964007.000001B54FB40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2156103082.000001B54EC90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/setuptools/
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: yM5WEfAX4h.exe, 00000001.00000002.2155937893.000001B54EB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io69882
Source: yM5WEfAX4h.exe, 00000001.00000002.2156559164.000001B54EEB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: yM5WEfAX4h.exe, 00000001.00000003.1011519225.000001B54E368000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011129574.000001B54E6C0000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011411383.000001B54E6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: yM5WEfAX4h.exe, 00000001.00000003.1011129574.000001B54E671000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011211319.000001B54E38B000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011129574.000001B54E6C0000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011411383.000001B54E6C0000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E6D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: yM5WEfAX4h.exe, 00000001.00000002.2155671273.000001B54EA60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: yM5WEfAX4h.exe, 00000001.00000003.1011129574.000001B54E671000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011129574.000001B54E6C0000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011411383.000001B54E6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:
Source: yM5WEfAX4h.exe, 00000001.00000003.1011129574.000001B54E671000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011129574.000001B54E6C0000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1011411383.000001B54E6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F2B5000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2157015691.000001B54F0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: tk.tcl.0.dr	String found in binary or memory: https://support.apple.com/en-us/HT201236
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: METADATA0.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E6D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1015316880.000001B54E943000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014971832.000001B54E931000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153090929.000001B54E047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: METADATA.0.dr	String found in binary or memory: https://wheel.readthedocs.io/
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
Source: yM5WEfAX4h.exe, 00000001.00000003.1012628589.000001B54E7CB000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: yM5WEfAX4h.exe, 00000001.00000002.2157316469.000001B54F332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: yM5WEfAX4h.exe, 00000001.00000002.2168220323.00007FFA21DA0000.00000002.00000001.01000000.00000014.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2166537611.00007FFA21393000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: yM5WEfAX4h.exe, 00000001.00000003.1012628589.000001B54E84A000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1012628589.000001B54E7CB000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014549740.000001B54E84A000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0427/
Source: yM5WEfAX4h.exe, 00000001.00000002.2152115402.000001B54DCD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: yM5WEfAX4h.exe, 00000001.00000002.2167436057.00007FFA21924000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: yM5WEfAX4h.exe, 00000001.00000002.2166908074.00007FFA217B4000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E94E000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1015316880.000001B54E943000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014971832.000001B54E931000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: yM5WEfAX4h.exe, 00000001.00000003.1015316880.000001B54E943000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014971832.000001B54E931000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000003.1014549740.000001B54E84A000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E7F0000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2154612173.000001B54E6D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636666030	0_2_00007FF636666030
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636641000	0_2_00007FF636641000
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636666DAC	0_2_00007FF636666DAC
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63664A34B	0_2_00007FF63664A34B
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636648BD0	0_2_00007FF636648BD0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366587B4	0_2_00007FF6366587B4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636660C30	0_2_00007FF636660C30
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63665DF50	0_2_00007FF63665DF50
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636664030	0_2_00007FF636664030
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636651FE4	0_2_00007FF636651FE4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366517C4	0_2_00007FF6366517C4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636649870	0_2_00007FF636649870
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636666854	0_2_00007FF636666854
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636658104	0_2_00007FF636658104
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636653600	0_2_00007FF636653600
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636651DD8	0_2_00007FF636651DD8
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63665E5C8	0_2_00007FF63665E5C8
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636659E6C	0_2_00007FF636659E6C
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636660C30	0_2_00007FF636660C30
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636651BD4	0_2_00007FF636651BD4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636661BD4	0_2_00007FF636661BD4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63666ACA0	0_2_00007FF63666ACA0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63664AD1D	0_2_00007FF63664AD1D
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63664A4E4	0_2_00007FF63664A4E4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366644BC	0_2_00007FF6366644BC
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366521E8	0_2_00007FF6366521E8
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366519C8	0_2_00007FF6366519C8
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366662B0	0_2_00007FF6366662B0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636669A80	0_2_00007FF636669A80
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636653A70	0_2_00007FF636653A70
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63665DAB8	0_2_00007FF63665DAB8
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636666030	1_2_00007FF636666030
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636641000	1_2_00007FF636641000
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636666DAC	1_2_00007FF636666DAC
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF6366587B4	1_2_00007FF6366587B4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636660C30	1_2_00007FF636660C30
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF63665DF50	1_2_00007FF63665DF50
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636664030	1_2_00007FF636664030
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636651FE4	1_2_00007FF636651FE4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF6366517C4	1_2_00007FF6366517C4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636649870	1_2_00007FF636649870
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636666854	1_2_00007FF636666854
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636658104	1_2_00007FF636658104
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636653600	1_2_00007FF636653600
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636651DD8	1_2_00007FF636651DD8
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF63665E5C8	1_2_00007FF63665E5C8
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF636659E6C	1_2_00007FF636659E6C
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20CD4180	1_2_00007FFA20CD4180
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C31120	1_2_00007FFA20C31120
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C840D0	1_2_00007FFA20C840D0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20CCD0D0	1_2_00007FFA20CCD0D0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C370C0	1_2_00007FFA20C370C0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C240F0	1_2_00007FFA20C240F0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20CCB0F0	1_2_00007FFA20CCB0F0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C38290	1_2_00007FFA20C38290
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20CC1250	1_2_00007FFA20CC1250
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20CC3210	1_2_00007FFA20CC3210
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C3C1C0	1_2_00007FFA20C3C1C0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C24390	1_2_00007FFA20C24390
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20CAA3A0	1_2_00007FFA20CAA3A0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C63370	1_2_00007FFA20C63370
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C8F360	1_2_00007FFA20C8F360
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C3B310	1_2_00007FFA20C3B310
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C94310	1_2_00007FFA20C94310
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C452D0	1_2_00007FFA20C452D0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FFA20C462C0	1_2_00007FFA20C462C0

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: String function: 00007FF636642910 appears 34 times
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: String function: 00007FF636642710 appears 90 times
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: String function: 00007FFA20C29D60 appears 36 times
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: String function: 00007FFA21D5CDA1 appears 87 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: zlib1.dll.0.dr

Static PE information: Number of sections : 12 > 10

Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-fibers-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: yM5WEfAX4h.exe, 00000000.00000003.984182097.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.909800565.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.989453335.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.991920612.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.1001509645.000001CA95A25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametcl86.dllP vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_elementtree.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.912651699.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.1001542584.000001CA95A03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes312.dll0 vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.909961307.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.992608005.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.910550285.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.990358383.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezlib1.dll* vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA959FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.910350136.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezlib1.dll* vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000002.2150984234.000001CA95A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.911560635.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe	Binary or memory string: OriginalFilename vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2175461339.00007FFA32B12000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2163341785.00007FFA20D80000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2168523985.00007FFA21EB2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2175653808.00007FFA32B57000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2174658009.00007FFA32483000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2175869277.00007FFA32D1C000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2173653177.00007FFA3217E000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2174208270.00007FFA322B9000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2174845162.00007FFA32656000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2170064465.00007FFA2F392000.00000002.00000001.01000000.0000001D.sdmp	Binary or memory string: OriginalFilenamepywintypes312.dll0 vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2173393022.00007FFA31E8D000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2150989151.000001B54C400000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2168220323.00007FFA21DA0000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenamelibsslH vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2176427664.00007FFA33D87000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2170584726.00007FFA2FD4F000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2166537611.00007FFA21393000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2171965342.00007FFA3174B000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2167979683.00007FFA21A4D000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2176140122.00007FFA32D56000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2164579920.00007FFA20EA4000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2172821411.00007FFA31809000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs yM5WEfAX4h.exe
Source: yM5WEfAX4h.exe, 00000001.00000002.2175140566.00007FFA32865000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs yM5WEfAX4h.exe

Source: classification engine

Classification label: mal60.spyw.winEXE@3/1025@1/1

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI69882

Jump to behavior

Source: yM5WEfAX4h.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,Caption FROM Win32_Processor

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: yM5WEfAX4h.exe, 00000001.00000002.2163000232.00007FFA20D4E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: yM5WEfAX4h.exe, 00000001.00000002.2163000232.00007FFA20D4E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: yM5WEfAX4h.exe, 00000001.00000002.2163000232.00007FFA20D4E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: yM5WEfAX4h.exe, 00000001.00000002.2163000232.00007FFA20D4E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: yM5WEfAX4h.exe, yM5WEfAX4h.exe, 00000001.00000002.2163000232.00007FFA20D4E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: yM5WEfAX4h.exe, 00000001.00000002.2163000232.00007FFA20D4E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: yM5WEfAX4h.exe, 00000001.00000002.2163000232.00007FFA20D4E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: yM5WEfAX4h.exe	Virustotal: Detection: 52%
Source: yM5WEfAX4h.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

File read: C:\Users\user\Desktop\yM5WEfAX4h.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\yM5WEfAX4h.exe "C:\Users\user\Desktop\yM5WEfAX4h.exe"
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Process created: C:\Users\user\Desktop\yM5WEfAX4h.exe "C:\Users\user\Desktop\yM5WEfAX4h.exe"
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Process created: C:\Users\user\Desktop\yM5WEfAX4h.exe "C:\Users\user\Desktop\yM5WEfAX4h.exe"	Jump to behavior

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: pywintypes312.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: yM5WEfAX4h.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: yM5WEfAX4h.exe

Static file information: File size 20559177 > 1048576

Source: yM5WEfAX4h.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: yM5WEfAX4h.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: yM5WEfAX4h.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: yM5WEfAX4h.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: yM5WEfAX4h.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: yM5WEfAX4h.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: yM5WEfAX4h.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: yM5WEfAX4h.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ucrtbase.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2168439649.00007FFA21E74000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: yM5WEfAX4h.exe, 00000001.00000002.2166132319.00007FFA21252000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.992608005.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.909800565.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2176325419.00007FFA33D81000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: yM5WEfAX4h.exe, 00000001.00000002.2169985248.00007FFA2F381000.00000002.00000001.01000000.0000001D.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb!! source: yM5WEfAX4h.exe, 00000001.00000002.2170505758.00007FFA2FD42000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911155502.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: yM5WEfAX4h.exe, 00000000.00000003.909961307.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2174142673.00007FFA322B5000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.991920612.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2175774858.00007FFA32D11000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: yM5WEfAX4h.exe, 00000000.00000003.910889949.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2173549364.00007FFA32177000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: yM5WEfAX4h.exe, 00000000.00000003.910066767.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2173276678.00007FFA31E82000.00000002.00000001.01000000.00000011.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.984182097.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2175032140.00007FFA3285C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: yM5WEfAX4h.exe, 00000000.00000003.910206418.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2175323228.00007FFA32B0D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.990358383.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: yM5WEfAX4h.exe, 00000001.00000002.2168439649.00007FFA21E74000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911432414.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2174578875.00007FFA32479000.00000002.00000001.01000000.0000000C.sdmp, _socket.pyd.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.992608005.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.909961307.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2174142673.00007FFA322B5000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.991920612.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2166908074.00007FFA217B4000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2163573196.00007FFA20E9F000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_elementtree.pdb source: yM5WEfAX4h.exe, 00000000.00000003.910753553.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: yM5WEfAX4h.exe, 00000001.00000002.2166132319.00007FFA21252000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.990358383.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2170505758.00007FFA2FD42000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911245168.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.984182097.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: yM5WEfAX4h.exe, 00000000.00000003.909800565.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2176325419.00007FFA33D81000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2163000232.00007FFA20D4E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2169985248.00007FFA2F381000.00000002.00000001.01000000.0000001D.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: yM5WEfAX4h.exe, 00000000.00000003.989453335.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2176056390.00007FFA32D53000.00000002.00000001.01000000.0000000D.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: yM5WEfAX4h.exe, 00000001.00000002.2168144250.00007FFA21D65000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: yM5WEfAX4h.exe, 00000000.00000003.911019916.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2175032140.00007FFA3285C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: yM5WEfAX4h.exe, 00000000.00000003.989453335.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: yM5WEfAX4h.exe, 00000000.00000003.911346417.000001CA95A01000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2174780715.00007FFA32653000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2175584468.00007FFA32B54000.00000002.00000001.01000000.00000010.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: yM5WEfAX4h.exe, 00000001.00000002.2175584468.00007FFA32B54000.00000002.00000001.01000000.00000010.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2171898659.00007FFA3173F000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2150989151.000001B54C400000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2168144250.00007FFA21D65000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: yM5WEfAX4h.exe, 00000001.00000002.2172623573.00007FFA317ED000.00000002.00000001.01000000.00000013.sdmp, _ssl.pyd.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr

Source: yM5WEfAX4h.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: yM5WEfAX4h.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: yM5WEfAX4h.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: yM5WEfAX4h.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: yM5WEfAX4h.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr

Static PE information: 0xAB340CE7 [Fri Jan 7 09:18:31 2061 UTC]

Source: yM5WEfAX4h.exe	Static PE information: section name: .fptable
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: zlib1.dll.0.dr	Static PE information: section name: .xdata
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: _imagingft.cp312-win_amd64.pyd.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imagingft.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imagingmath.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imagingcms.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_webp.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\tcl86t.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imaging.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imagingtk.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\tk86t.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Code function: 0_2_00007FF636645820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF636645820

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imagingft.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imagingmath.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imagingcms.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_webp.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\tcl86t.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imaging.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL\_imagingtk.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\tk86t.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17389

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

API coverage: 6.7 %

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,Caption FROM Win32_Processor

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366492F0 FindFirstFileExW,FindClose,	0_2_00007FF6366492F0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF6366483B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6366483B0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF636661BD4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF636661BD4
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF6366492F0 FindFirstFileExW,FindClose,	1_2_00007FF6366492F0
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF6366483B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6366483B0

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Code function: 1_2_00007FFA20C30180 GetSystemInfo,

1_2_00007FFA20C30180

Source: cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: yM5WEfAX4h.exe, 00000001.00000003.1011519225.000001B54E368000.00000004.00000020.00020000.00000000.sdmp, yM5WEfAX4h.exe, 00000001.00000002.2153895249.000001B54E34F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWrror%SystemRoot%\system32\mswsock.dll
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Code function: 0_2_00007FF63665A5C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF63665A5C8

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Code function: 0_2_00007FF636663830 GetProcessHeap,

0_2_00007FF636663830

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63664C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF63664C910
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63665A5C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF63665A5C8
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63664D37C SetUnhandledExceptionFilter,	0_2_00007FF63664D37C
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 0_2_00007FF63664D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF63664D19C
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF63664C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF63664C910
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Code function: 1_2_00007FF63665A5C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF63665A5C8

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Process created: C:\Users\user\Desktop\yM5WEfAX4h.exe "C:\Users\user\Desktop\yM5WEfAX4h.exe"

Jump to behavior

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Code function: 0_2_00007FF6366697F0 cpuid

0_2_00007FF6366697F0

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\http1.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\opt0.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_tcl_data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69882 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yM5WEfAX4h.exe	Queries volume information: C:\Users\user\Desktop\yM5WEfAX4h.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Code function: 0_2_00007FF63664D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF63664D080

Source: C:\Users\user\Desktop\yM5WEfAX4h.exe

Code function: 0_2_00007FF636666030 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF636666030

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: W;fJaxx
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: yM5WEfAX4h.exe, 00000001.00000002.2156824760.000001B54EFB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keystore

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
yM5WEfAX4h.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yM5WEfAX4h.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
yM5WEfAX4h.exe