Windows Analysis Report
VenomBlob.exe

General Information

Sample name: VenomBlob.exe
Analysis ID: 1686575
Has dependencies: false
MD5: c66749b1fd3d97d2ee3b2542a18fc4c4
SHA1: d9ac8cd4b5084a5be41ec6a663a6e98c530fd291
SHA256: b80d6a2777e2eb9e0fa3625b6755b471e9a7fc677b28b06f0ee845832cfab87f
Tags: exeuser-FrenchChen
Infos:

Detection

Score: 48
Range: 0 - 100
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: VenomBlob.exe Virustotal: Detection: 8% Perma Link
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8472A11E0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyObject_GetBuffer,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError, 2_2_00007FF8472A11E0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8472A5DC0 CRYPTO_memcmp, 2_2_00007FF8472A5DC0
Source: VenomBlob.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: cryptography_rust.pdbc source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: ucrtbase.pdb source: VenomBlob.exe, 00000002.00000002.1440865052.00007FF827D01000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: VenomBlob.exe, 00000002.00000002.1438431722.00007FF8274A2000.00000002.00000001.01000000.00000009.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: VenomBlob.exe, 00000000.00000003.1311378939.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1442074614.00007FF847524000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1441862599.00007FF8472A6000.00000002.00000001.01000000.00000008.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1441360710.00007FF83F60B000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1441629612.00007FF8406DD000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: ucrtbase.pdbUGP source: VenomBlob.exe, 00000002.00000002.1440865052.00007FF827D01000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source: Binary string: cryptography_rust.pdb source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: VenomBlob.exe, 00000002.00000002.1439212331.00007FF827A08000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: VenomBlob.exe, 00000002.00000002.1438431722.00007FF82753A000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: VenomBlob.exe, 00000000.00000003.1311378939.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1442074614.00007FF847524000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: VenomBlob.exe, 00000002.00000002.1438431722.00007FF82753A000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: select.pyd.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1441360710.00007FF83F60B000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: VenomBlob.exe, 00000002.00000002.1435934423.00000274D52E0000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0687E0 FindFirstFileExW,FindClose, 0_2_00007FF72A0687E0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A067820 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF72A067820
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A082A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF72A082A84
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0687E0 FindFirstFileExW,FindClose, 0_0_00007FF72A0687E0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A067820 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_0_00007FF72A067820
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A082A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_0_00007FF72A082A84
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0687E0 FindFirstFileExW,FindClose, 2_2_00007FF72A0687E0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A082A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00007FF72A082A84
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A067820 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 2_2_00007FF72A067820
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CBEFEC FindFirstFileExW,FindClose,FindNextFileW, 2_2_00007FF827CBEFEC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C92DFC FindFirstFileExW, 2_2_00007FF827C92DFC
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1313055511.000001CB4EF39000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1313055511.000001CB4EF39000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1313055511.000001CB4EF39000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: tcl86t.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1313055511.000001CB4EF39000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1313055511.000001CB4EF39000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: VenomBlob.exe, VenomBlob.exe, 00000002.00000002.1441125138.00007FF82BF5C000.00000002.00000001.01000000.0000000B.sdmp, _cffi_backend.cp313-win_amd64.pyd.0.dr String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/security/
Source: http-2.9.8.tm.0.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection
Source: VenomBlob.exe, 00000002.00000003.1418199007.00000274D4D95000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1415505083.00000274D4D82000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1417118496.00000274D4D81000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1416342019.00000274D4D82000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: VenomBlob.exe, 00000002.00000003.1414217432.00000274D4D24000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1435445723.00000274D50E0000.00000004.00001000.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1414069666.00000274D4D60000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: VenomBlob.exe, 00000002.00000003.1421418799.00000274D4CD9000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1432515510.00000274D4A90000.00000004.00001000.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1429163248.00000274D4CED000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1419576728.00000274D4CD9000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1422321423.00000274D4CEA000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1426991662.00000274D4CEB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: VenomBlob.exe, 00000002.00000002.1432515510.00000274D4A90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: VenomBlob.exe, 00000002.00000002.1432515510.00000274D4B14000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: VenomBlob.exe, 00000002.00000002.1432515510.00000274D4A90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: VenomBlob.exe, 00000002.00000002.1432515510.00000274D4B14000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: VenomBlob.exe, 00000002.00000002.1432515510.00000274D4A90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: VenomBlob.exe, 00000002.00000002.1432515510.00000274D4A90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: VenomBlob.exe, 00000002.00000002.1432515510.00000274D4A90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: VenomBlob.exe, 00000002.00000003.1427101358.00000274D4CC4000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1432871762.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1422389786.00000274D4CC3000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1421418799.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1419576728.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1431404208.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: VenomBlob.exe, 00000002.00000003.1420401429.00000274D3178000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1425242171.00000274D317D000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1427101358.00000274D4CC4000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1422256802.00000274D3179000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1432299456.00000274D31B0000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1429731941.00000274D31AC000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1432871762.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1430808398.00000274D31B0000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1422389786.00000274D4CC3000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1421418799.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1419576728.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1431404208.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1429351993.00000274D31A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: VenomBlob.exe, 00000002.00000002.1432515510.00000274D4B14000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: VenomBlob.exe, 00000002.00000003.1429351993.00000274D31A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: VenomBlob.exe, 00000002.00000003.1420401429.00000274D3178000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1425242171.00000274D317D000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1427101358.00000274D4CC4000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1422256802.00000274D3179000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1432299456.00000274D31B0000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1429731941.00000274D31AC000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1432871762.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1430808398.00000274D31B0000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1422389786.00000274D4CC3000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1421418799.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1419576728.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1431404208.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1429351993.00000274D31A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: VenomBlob.exe, 00000002.00000003.1427340682.00000274D4EE5000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1415775077.00000274D5052000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1434139454.00000274D4EE6000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1427991842.00000274D4EE6000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1416342019.00000274D4D57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: VenomBlob.exe, 00000002.00000003.1420401429.00000274D3178000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1425242171.00000274D317D000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1427101358.00000274D4CC4000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1422256802.00000274D3179000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1432299456.00000274D31B0000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1429731941.00000274D31AC000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1432871762.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1430808398.00000274D31B0000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1422389786.00000274D4CC3000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1421418799.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1419576728.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1431404208.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1429351993.00000274D31A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: METADATA.0.dr String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: METADATA.0.dr String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: VenomBlob.exe, 00000002.00000002.1435602286.00000274D51F8000.00000004.00001000.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1411761493.00000274D4CA1000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr String found in binary or memory: https://peps.python.org/pep-0205/
Source: VenomBlob.exe, 00000002.00000002.1439212331.00007FF827A08000.00000002.00000001.01000000.00000005.sdmp String found in binary or memory: https://peps.python.org/pep-0263/
Source: VenomBlob.exe, 00000002.00000002.1432669174.00000274D4BA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://peps.python.org/pep-0506/
Source: METADATA.0.dr String found in binary or memory: https://pypi.org/project/cryptography/
Source: METADATA.0.dr String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: tk.tcl.0.dr String found in binary or memory: https://support.apple.com/en-us/HT201236
Source: LICENSE.APACHE.0.dr String found in binary or memory: https://www.apache.org/licenses/
Source: LICENSE.APACHE.0.dr String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: VenomBlob.exe, 00000002.00000003.1427101358.00000274D4CC4000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1432871762.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1422389786.00000274D4CC3000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1421418799.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1419576728.00000274D4CBF000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000003.1431404208.00000274D4CC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.exodus.com/
Source: VenomBlob.exe, 00000002.00000002.1438821273.00007FF8275E4000.00000002.00000001.01000000.00000009.sdmp, legacy.dll.0.dr String found in binary or memory: https://www.openssl.org/H
Source: VenomBlob.exe, 00000002.00000002.1439212331.00007FF827A08000.00000002.00000001.01000000.00000005.sdmp String found in binary or memory: https://www.python.org/psf/license/)
Detected potential crypto function
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A087B74 0_2_00007FF72A087B74
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A081AD8 0_2_00007FF72A081AD8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A086E10 0_2_00007FF72A086E10
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A067E40 0_2_00007FF72A067E40
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A073B28 0_2_00007FF72A073B28
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0723C0 0_2_00007FF72A0723C0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0743F0 0_2_00007FF72A0743F0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A076C90 0_2_00007FF72A076C90
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A070CB8 0_2_00007FF72A070CB8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0714D8 0_2_00007FF72A0714D8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A08A938 0_2_00007FF72A08A938
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0699D4 0_2_00007FF72A0699D4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A06A20D 0_2_00007FF72A06A20D
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A082A84 0_2_00007FF72A082A84
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0712CC 0_2_00007FF72A0712CC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0852BC 0_2_00007FF72A0852BC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A07EAC4 0_2_00007FF72A07EAC4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A073F2C 0_2_00007FF72A073F2C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A07EF58 0_2_00007FF72A07EF58
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A072758 0_2_00007FF72A072758
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A078FC0 0_2_00007FF72A078FC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A06983B 0_2_00007FF72A06983B
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A08708C 0_2_00007FF72A08708C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0710C8 0_2_00007FF72A0710C8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A068D60 0_2_00007FF72A068D60
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A07ADC0 0_2_00007FF72A07ADC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A07F5D8 0_2_00007FF72A07F5D8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A087628 0_2_00007FF72A087628
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A081AD8 0_2_00007FF72A081AD8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A084E20 0_2_00007FF72A084E20
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A079670 0_2_00007FF72A079670
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A070EBC 0_2_00007FF72A070EBC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0736F0 0_2_00007FF72A0736F0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0716DC 0_2_00007FF72A0716DC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A087B74 0_0_00007FF72A087B74
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A081AD8 0_0_00007FF72A081AD8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A086E10 0_0_00007FF72A086E10
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A067E40 0_0_00007FF72A067E40
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A073B28 0_0_00007FF72A073B28
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0723C0 0_0_00007FF72A0723C0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0743F0 0_0_00007FF72A0743F0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A076C90 0_0_00007FF72A076C90
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A070CB8 0_0_00007FF72A070CB8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0714D8 0_0_00007FF72A0714D8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A08A938 0_0_00007FF72A08A938
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0699D4 0_0_00007FF72A0699D4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A06A20D 0_0_00007FF72A06A20D
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A082A84 0_0_00007FF72A082A84
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0712CC 0_0_00007FF72A0712CC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0852BC 0_0_00007FF72A0852BC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A07EAC4 0_0_00007FF72A07EAC4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A073F2C 0_0_00007FF72A073F2C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A07EF58 0_0_00007FF72A07EF58
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A072758 0_0_00007FF72A072758
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A078FC0 0_0_00007FF72A078FC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A06983B 0_0_00007FF72A06983B
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A08708C 0_0_00007FF72A08708C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0710C8 0_0_00007FF72A0710C8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A068D60 0_0_00007FF72A068D60
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A07ADC0 0_0_00007FF72A07ADC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A07F5D8 0_0_00007FF72A07F5D8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A087628 0_0_00007FF72A087628
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A081AD8 0_0_00007FF72A081AD8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A084E20 0_0_00007FF72A084E20
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A079670 0_0_00007FF72A079670
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A070EBC 0_0_00007FF72A070EBC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0736F0 0_0_00007FF72A0736F0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0716DC 0_0_00007FF72A0716DC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A087B74 2_2_00007FF72A087B74
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A073F2C 2_2_00007FF72A073F2C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A06983B 2_2_00007FF72A06983B
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A086E10 2_2_00007FF72A086E10
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A073B28 2_2_00007FF72A073B28
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0723C0 2_2_00007FF72A0723C0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0743F0 2_2_00007FF72A0743F0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A076C90 2_2_00007FF72A076C90
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A070CB8 2_2_00007FF72A070CB8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0714D8 2_2_00007FF72A0714D8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A08A938 2_2_00007FF72A08A938
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0699D4 2_2_00007FF72A0699D4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A06A20D 2_2_00007FF72A06A20D
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A082A84 2_2_00007FF72A082A84
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0712CC 2_2_00007FF72A0712CC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0852BC 2_2_00007FF72A0852BC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A07EAC4 2_2_00007FF72A07EAC4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A081AD8 2_2_00007FF72A081AD8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A07EF58 2_2_00007FF72A07EF58
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A072758 2_2_00007FF72A072758
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A078FC0 2_2_00007FF72A078FC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A08708C 2_2_00007FF72A08708C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0710C8 2_2_00007FF72A0710C8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A068D60 2_2_00007FF72A068D60
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A07ADC0 2_2_00007FF72A07ADC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A07F5D8 2_2_00007FF72A07F5D8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A087628 2_2_00007FF72A087628
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A081AD8 2_2_00007FF72A081AD8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A084E20 2_2_00007FF72A084E20
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A067E40 2_2_00007FF72A067E40
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A079670 2_2_00007FF72A079670
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A070EBC 2_2_00007FF72A070EBC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0736F0 2_2_00007FF72A0736F0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0716DC 2_2_00007FF72A0716DC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CBE864 2_2_00007FF827CBE864
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C587D0 2_2_00007FF827C587D0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C657B8 2_2_00007FF827C657B8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C64788 2_2_00007FF827C64788
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CB46F8 2_2_00007FF827CB46F8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C7D6E0 2_2_00007FF827C7D6E0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C92694 2_2_00007FF827C92694
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C6C6B0 2_2_00007FF827C6C6B0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C526A0 2_2_00007FF827C526A0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C58650 2_2_00007FF827C58650
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C70580 2_2_00007FF827C70580
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C7654C 2_2_00007FF827C7654C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C7C570 2_2_00007FF827C7C570
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C6D408 2_2_00007FF827C6D408
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C5A400 2_2_00007FF827C5A400
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C6641C 2_2_00007FF827C6641C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C622F0 2_2_00007FF827C622F0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CDB2AC 2_2_00007FF827CDB2AC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C522A4 2_2_00007FF827C522A4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C5423C 2_2_00007FF827C5423C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C59120 2_2_00007FF827C59120
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C5B0B0 2_2_00007FF827C5B0B0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C53000 2_2_00007FF827C53000
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C5A030 2_2_00007FF827C5A030
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C92EC0 2_2_00007FF827C92EC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CBCEC0 2_2_00007FF827CBCEC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C6CEC0 2_2_00007FF827C6CEC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C58EA0 2_2_00007FF827C58EA0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CBEE44 2_2_00007FF827CBEE44
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C7BE10 2_2_00007FF827C7BE10
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C66E30 2_2_00007FF827C66E30
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CBDDF0 2_2_00007FF827CBDDF0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C78D50 2_2_00007FF827C78D50
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C58D30 2_2_00007FF827C58D30
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C8ACC4 2_2_00007FF827C8ACC4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CF5CC0 2_2_00007FF827CF5CC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C6DC60 2_2_00007FF827C6DC60
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C5DC30 2_2_00007FF827C5DC30
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C52B90 2_2_00007FF827C52B90
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C5BBB0 2_2_00007FF827C5BBB0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C7AB55 2_2_00007FF827C7AB55
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C51AF8 2_2_00007FF827C51AF8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C6CAE4 2_2_00007FF827C6CAE4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CBEA3C 2_2_00007FF827CBEA3C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C55A20 2_2_00007FF827C55A20
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C53984 2_2_00007FF827C53984
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C6195E 2_2_00007FF827C6195E
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CF495C 2_2_00007FF827CF495C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF82BF49F80 2_2_00007FF82BF49F80
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F73FC 2_2_00007FF83F5F73FC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F8F60 2_2_00007FF83F5F8F60
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F5F00 2_2_00007FF83F5F5F00
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F23B0 2_2_00007FF83F5F23B0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F2F80 2_2_00007FF83F5F2F80
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F4650 2_2_00007FF83F5F4650
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F1A00 2_2_00007FF83F5F1A00
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F12B0 2_2_00007FF83F5F12B0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F1920 2_2_00007FF83F5F1920
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5FF534 2_2_00007FF83F5FF534
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F5F55D0 2_2_00007FF83F5F55D0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8406D6060 2_2_00007FF8406D6060
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8406DC858 2_2_00007FF8406DC858
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8406D3B20 2_2_00007FF8406D3B20
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8406D1000 2_2_00007FF8406D1000
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8406D3DC0 2_2_00007FF8406D3DC0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8406D2DA0 2_2_00007FF8406D2DA0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8472A1E20 2_2_00007FF8472A1E20
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8472A11E0 2_2_00007FF8472A11E0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: String function: 00007FF827C56448 appears 32 times
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: String function: 00007FF72A062020 appears 51 times
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: String function: 00007FF72A061E50 appears 159 times
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: String function: 00007FF72A06BDB0 appears 33 times
Sample file is different than original file name gathered from version info
Source: VenomBlob.exe, 00000000.00000003.1312306790.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs VenomBlob.exe
Source: VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs VenomBlob.exe
Source: VenomBlob.exe, 00000000.00000003.1311378939.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs VenomBlob.exe
Source: VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs VenomBlob.exe
Source: VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs VenomBlob.exe
Source: VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs VenomBlob.exe
Source: VenomBlob.exe Binary or memory string: OriginalFilename vs VenomBlob.exe
Source: VenomBlob.exe, 00000002.00000002.1440963785.00007FF827D3C000.00000002.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs VenomBlob.exe
Source: VenomBlob.exe, 00000002.00000002.1441715346.00007FF8406E2000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs VenomBlob.exe
Source: VenomBlob.exe, 00000002.00000002.1441490001.00007FF83F613000.00000002.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs VenomBlob.exe
Source: VenomBlob.exe, 00000002.00000002.1438821273.00007FF8275E4000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs VenomBlob.exe
Source: VenomBlob.exe, 00000002.00000002.1440674922.00007FF827C40000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamepython313.dll. vs VenomBlob.exe
Source: VenomBlob.exe, 00000002.00000002.1441936482.00007FF8472AD000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs VenomBlob.exe
Source: VenomBlob.exe, 00000002.00000002.1435934423.00000274D52E0000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs VenomBlob.exe
Source: VenomBlob.exe, 00000002.00000002.1442166429.00007FF84752A000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs VenomBlob.exe
Source: classification engine Classification label: mal48.winEXE@4/993@0/0
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\3D Objects\cromeupdate.txt Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282 Jump to behavior
Source: VenomBlob.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\VenomBlob.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: VenomBlob.exe Virustotal: Detection: 8%
Source: C:\Users\user\Desktop\VenomBlob.exe File read: C:\Users\user\Desktop\VenomBlob.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\VenomBlob.exe "C:\Users\user\Desktop\VenomBlob.exe"
Source: C:\Users\user\Desktop\VenomBlob.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VenomBlob.exe Process created: C:\Users\user\Desktop\VenomBlob.exe "C:\Users\user\Desktop\VenomBlob.exe"
Source: C:\Users\user\Desktop\VenomBlob.exe Process created: C:\Users\user\Desktop\VenomBlob.exe "C:\Users\user\Desktop\VenomBlob.exe" Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Section loaded: libcrypto-3.dll Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: VenomBlob.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: VenomBlob.exe Static file information: File size 16181738 > 1048576
Source: VenomBlob.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: VenomBlob.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: VenomBlob.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: VenomBlob.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: VenomBlob.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: VenomBlob.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: VenomBlob.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: VenomBlob.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: cryptography_rust.pdbc source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: ucrtbase.pdb source: VenomBlob.exe, 00000002.00000002.1440865052.00007FF827D01000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: VenomBlob.exe, 00000002.00000002.1438431722.00007FF8274A2000.00000002.00000001.01000000.00000009.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: VenomBlob.exe, 00000000.00000003.1311378939.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1442074614.00007FF847524000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: VenomBlob.exe, 00000000.00000003.1312493085.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1441862599.00007FF8472A6000.00000002.00000001.01000000.00000008.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1441360710.00007FF83F60B000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: VenomBlob.exe, 00000000.00000003.1311889600.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1441629612.00007FF8406DD000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: ucrtbase.pdbUGP source: VenomBlob.exe, 00000002.00000002.1440865052.00007FF827D01000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: VenomBlob.exe, 00000000.00000003.1312884625.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source: Binary string: cryptography_rust.pdb source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: VenomBlob.exe, 00000002.00000002.1439212331.00007FF827A08000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: VenomBlob.exe, 00000002.00000002.1438431722.00007FF82753A000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: VenomBlob.exe, 00000002.00000002.1437385797.00007FF826F0A000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: VenomBlob.exe, 00000000.00000003.1311378939.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1442074614.00007FF847524000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: VenomBlob.exe, 00000002.00000002.1438431722.00007FF82753A000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: select.pyd.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: VenomBlob.exe, 00000000.00000003.1312665317.000001CB4EF2C000.00000004.00000020.00020000.00000000.sdmp, VenomBlob.exe, 00000002.00000002.1441360710.00007FF83F60B000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: VenomBlob.exe, 00000002.00000002.1435934423.00000274D52E0000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: VenomBlob.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: VenomBlob.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: VenomBlob.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: VenomBlob.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: VenomBlob.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C7983D push rdi; ret 2_2_00007FF827C79844
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C744F9 push rdi; ret 2_2_00007FF827C74502
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C79F52 push rdi; ret 2_2_00007FF827C79F56
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C74A15 push rdi; ret 2_2_00007FF827C74A1B
Drops PE files
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\tcl86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\zlib1.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\libcrypto-3-x64.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\python313.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\tk86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\ossl-modules\legacy.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\libcrypto-3.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\_cffi_backend.cp313-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73282\VCRUNTIME140.dll Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A066B20 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError, 0_2_00007FF72A066B20
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\tcl86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\zlib1.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\libcrypto-3-x64.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\python313.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\tk86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\ossl-modules\legacy.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\_cffi_backend.cp313-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\VenomBlob.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73282\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\VenomBlob.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\VenomBlob.exe API coverage: 1.6 %
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A0687E0 FindFirstFileExW,FindClose, 0_2_00007FF72A0687E0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A067820 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF72A067820
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A082A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF72A082A84
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A0687E0 FindFirstFileExW,FindClose, 0_0_00007FF72A0687E0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A067820 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_0_00007FF72A067820
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A082A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_0_00007FF72A082A84
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A0687E0 FindFirstFileExW,FindClose, 2_2_00007FF72A0687E0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A082A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00007FF72A082A84
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A067820 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 2_2_00007FF72A067820
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CBEFEC FindFirstFileExW,FindClose,FindNextFileW, 2_2_00007FF827CBEFEC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C92DFC FindFirstFileExW, 2_2_00007FF827C92DFC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF82BF4BEB0 _Py_NoneStruct,PyArg_ParseTuple,GetSystemInfo,VirtualAlloc,_Py_Dealloc,PyExc_MemoryError,PyErr_SetString,_PyObject_GC_New,PyExc_NotImplementedError,PyErr_Format,Py_FatalError,PyObject_GC_Track,PyExc_SystemError,PyErr_SetString,_Py_Dealloc,_Py_Dealloc, 2_2_00007FF82BF4BEB0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A07B4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF72A07B4F8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A084690 GetProcessHeap, 0_2_00007FF72A084690
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A07B4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF72A07B4F8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A06C840 SetUnhandledExceptionFilter, 0_2_00007FF72A06C840
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A06BE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF72A06BE00
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A06C69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF72A06C69C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A07B4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_0_00007FF72A07B4F8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A06C840 SetUnhandledExceptionFilter, 0_0_00007FF72A06C840
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A06BE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_0_00007FF72A06BE00
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_0_00007FF72A06C69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_0_00007FF72A06C69C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A07B4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF72A07B4F8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A06C840 SetUnhandledExceptionFilter, 2_2_00007FF72A06C840
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A06BE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF72A06BE00
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF72A06C69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF72A06C69C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827C922DC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF827C922DC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF827CBCC28 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF827CBCC28
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF82BF5AD98 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF82BF5AD98
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF82BF5A450 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF82BF5A450
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F6037E0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF83F6037E0
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF83F603220 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF83F603220
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8406DA9AC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF8406DA9AC
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8406D9F80 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF8406D9F80
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8472A4390 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF8472A4390
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 2_2_00007FF8472A3DD0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF8472A3DD0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\VenomBlob.exe Process created: C:\Users\user\Desktop\VenomBlob.exe "C:\Users\user\Desktop\VenomBlob.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A08A780 cpuid 0_2_00007FF72A08A780
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 2_2_00007FF827CBB62C
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 2_2_00007FF827CBB4B8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: GetPrimaryLen,EnumSystemLocalesW, 2_2_00007FF827CBB074
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: GetPrimaryLen,EnumSystemLocalesW, 2_2_00007FF827CBAFC4
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: EnterCriticalSection,EnumSystemLocalesW,LeaveCriticalSection, 2_2_00007FF827CB8FB8
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: EnumSystemLocalesW, 2_2_00007FF827CBAF64
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: GetProcAddress,GetLocaleInfoW, 2_2_00007FF827C53AE0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\http1.0 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_tcl_data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\ucrtbase.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73282\_hashlib.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Queries volume information: C:\Users\user\Desktop\VenomBlob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A06C580 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF72A06C580
Source: C:\Users\user\Desktop\VenomBlob.exe Code function: 0_2_00007FF72A086E10 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 0_2_00007FF72A086E10
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1686575 Sample: VenomBlob.exe Startdate: 10/05/2025 Architecture: WINDOWS Score: 48 12 Multi AV Scanner detection for submitted file 2->12 6 VenomBlob.exe 1002 2->6         started        process3 process4 8 VenomBlob.exe 2 6->8         started        10 conhost.exe 6->10         started       
⊘No contacted IP infos