Windows Analysis Report
msupdate.exe

Overview

General Information

Sample name: msupdate.exe
Analysis ID: 1467960
MD5: a4a77855a747fd6c8a28cfa4e0e3b22f
SHA1: a201051faf269ffa09dee1b3d0ea8db4958aba7c
SHA256: 3595fb2e596d3e1ab25f1671e4d0b541924fae29fd7ffbda09a929978707609a
Infos:

Detection

Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Python Keylogger
AI detected suspicious sample
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected EXE embedded in BAT file
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses a known web browser user agent for HTTP communication
Yara detected Credential Stealer

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: msupdate.exe ReversingLabs: Detection: 23%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: geolocation-db.com
Source: msupdate.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb++ source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qoffscreen.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\dsengine.pdbdd" source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\dsengine.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\unicodedata.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: placed in the .pdbrc file): source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.amd64.pdbGCTL source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbRR source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc) source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: vcruntime140.amd64.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: signToolcAToolsignToolCertcAToolCertISSUER_SIGN_TOOLv2i_issuer_sign_toolcrypto\x509\v3_ist.ci2r_issuer_sign_tool%*ssignTool : %*scATool : %*ssignToolCert: %*scAToolCert : compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: PKCS8_encrypt_excrypto\pkcs12\p12_p8e.cPKCS8_set0_pbe_excrypto\bio\bio_sock.cBIO_sock_initcalling wsastartup()BIO_socket_ioctlcalling ioctlsocket()i2d_ASN1_bio_streamcrypto\asn1\asn_mime.cB64_write_ASN1-----BEGIN %s----- source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bob\openssl-1.0.2s\out32dll\ssleay32.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\printsupport\windowsprintersupport.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qminimal.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\wmfengine.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qoffscreen.pdbKK source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: challengeNETSCAPE_SPKACspkacsig_algorcrypto\bn\bn_exp.cBN_mod_exp_recpBN_mod_exp_mont_wordX509V3_EXT_nconf_intcrypto\x509\v3_conf.csection=%s, name=%s, value=%sdo_ext_nconfname=%s,section=%sdo_ext_i2dX509V3_EXT_i2dcritical,DER:ASN1:v3_generic_extensionvalue=%sX509V3_get_sectioncrypto\x509\v3_lib.cX509V3_add1_i2dcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC3.0.5built on: Tue Jul 5 11:53:43 2022 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot available source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\bob\openssl-1.0.2s\out32dll\ssleay32.pdbFF source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\select.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ~/.pdbrcz source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb11 source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\opencv-python\opencv-python\_skbuild\win-amd64-3.7\cmake-build\lib\python3\Release\cv2.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CCF85000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qminimal.pdbPP source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\cryptography\cryptography\cryptography-37.0.4\src\rust\target\release\deps\cryptography_rust.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5D0719000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\sqlite3.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\wmfengine.pdbLL' source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Temp\ONEFIL~1\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.8:49723 -> 121.127.33.39:9333
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.159.137.232 162.159.137.232
Source: Joe Sandbox View IP Address: 151.80.29.83 151.80.29.83
Source: Joe Sandbox View IP Address: 159.89.102.253 159.89.102.253
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 331Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 550Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 549Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 405Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 331Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 550Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 549Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 331Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 550Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 405Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 549Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 405Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: api.gofile.io
Source: global traffic DNS traffic detected: DNS query: geolocation-db.com
Source: global traffic DNS traffic detected: DNS query: discord.com
Source: unknown HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 331Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CF013000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CF013000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://aia.startssl.com/certs/ca.crt0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://aia.startssl.com/certs/sca.code3.crt06
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arxiv.org/abs/1805.10941.
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://caffe.berkeleyvision.org
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://caffe.berkeleyvision.org/)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://campar.in.tum.de/Chair/HandEyeCalibration).
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.476.5736&rep=rep1&type=pdf
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.131.6394
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.startssl.com/sca-code3.crl0#
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.startssl.com/sfsca.crl0f
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://docs.python.org/library/unittest.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://dx.doi.org/10.1016/j.cviu.2010.01.011
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://foo/bar.tar.gz
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://foo/bar.tgz
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://graphics.berkeley.edu/papers/Tao-SAN-2012-05/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://homepages.inf.ed.ac.uk/rbf/HIPR2/hough.htm
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CF013000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62433E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://httpbin.org/post
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://json.org
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lear.inrialpes.fr/src/deepmatching/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mathworld.wolfram.com/BinomialDistribution.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mathworld.wolfram.com/CauchyDistribution.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mathworld.wolfram.com/GammaDistribution.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mathworld.wolfram.com/HypergeometricDistribution.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mathworld.wolfram.com/LaplaceDistribution.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mathworld.wolfram.com/LogisticDistribution.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mathworld.wolfram.com/NegativeBinomialDistribution.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mathworld.wolfram.com/NoncentralF-Distribution.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mathworld.wolfram.com/PoissonDistribution.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.startssl.com00
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.startssl.com07
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://pracrand.sourceforge.net/RNG_engines.txt
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62433E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://python.org/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://tip.tcl.tk/48)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://torch.ch
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://torch.ch/)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://underdestruction.com/2004/02/25/stackblur-2004.
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cs.tut.fi/~foi/GCF-BM3D/BM3D_TIP_2007.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.dabeaz.com/ply)Fz
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.dai.ed.ac.uk/CVonline/LOCAL_COPIES/MANDUCHI1/Bilateral_Filtering.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gdal.org)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gdal.org/formats_list.html)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gdal.org/ogr_formats.html).
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.iana.org/assignments/character-sets
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml)-r(
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ifp.illinois.edu/~vuongle2/helen/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.inf.ufrgs.br/~eslgastal/DomainTransform/).
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.inf.ufrgs.br/~eslgastal/DomainTransform/).COLOR_SPACE_Lab_D75_2MORPH_CROSSCAP_PROP_DC1394
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.inference.org.uk/mackay/itila/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ipol.im/pub/algo/bcm_non_local_means_denoising
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ipol.im/pub/algo/bcm_non_local_means_denoising/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ipol.im/pub/art/2011/ys-dct/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/JUMP/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.math.sfu.ca/~cbm/aands/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.math.sfu.ca/~cbm/aands/page_69.htm
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.megginson.com/SAX/.
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.nightmare.com/squirl/python-ext/misc/syslog.py
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.openssl.org/V
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pcg-random.org/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pcg-random.org/posts/random-invertible-mapping-statistics.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.python.org/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.rfc-editor.org/rfc/rfc%d.txtz(http://www.python.org/dev/peps/pep-%04d/r2
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.startssl.com/0P
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.startssl.com/policy0
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.xmlrpc.com/discuss/msgReader$1208
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.xmlrpc.com/discuss/msgReader$1208z
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zlib.net/D
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://wwwsearch.sf.net/):
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://xml.org/sax/features/namespaces
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://xml.org/sax/features/namespacesz.http://xml.org/sax/features/namespace-prefixesz
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://xml.org/sax/features/string-interningz&http://xml.org/sax/features/validationz5http://xml.org
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://xml.python.org/entities/fragment-builder/internalz
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://xmlrpc.usefulinc.com/doc/reserved.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://aliexpress.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://amazon.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://api.gofile.io/getServer
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://api.gofile.io/getServerajsonaserveru.gofile.io/uploadFileafileadownloadPageapathFwil
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://api.ipify.org
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://api.ipify.orgareadadecodeastripa__mro_entries__abasesaintacbDataapbDataac_bufferacdllamsvcrt
Source: localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://api.ipify.orgareadadecodeastripaintacbDataapbDataac_bufferacdllamsvcrtamemcpyawindllakernel3
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://arxiv.org/abs/1704.04503
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://binance.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://brew.sh
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62433E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://bugs.python.org/issue37179
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wiki
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://coinbase.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://coinbase.com)u
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://crunchyroll.com)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D0719000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://cryptography.io/en/latest/hazmat/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dejavu-fonts.github.io/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://discord.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://discord.com)u
Source: localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://discord.com/api/users/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://discord.com/api/v6/users/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62393E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://discord.com/api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKF
Source: localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://discordapp.com/api/v6/users/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://disney.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62433E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62433E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://docs.python.org/3.7/library/asyncio-eventloop.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.resources.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62433E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62433E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSIONaset_default_verify_pathsuSSL
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://ebay.com)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://engineering.purdue.edu/~malcolm/pct/CTI_Ch03.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://epicgames.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://exiv2.org/tags.html)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://expressvpn.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://geolocation-db.com/jsonp/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://geolocation-db.com/jsonp/areplaceT
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/imneme/540829265469e673d045
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/NVIDIA/caffe.
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62433E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/baidut/BIMEF).
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/libsdl-org/SDL.git
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/opencv/opencv/issues/16736
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/opencv/opencv/issues/16739
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/opencv/opencv/issues/16739cv::MatOp_AddEx::assign
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/opencv/opencv/issues/6293
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/opencv/opencv/issues/6293u-
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/opencv/opencv_contrib/blob/master/modules/text/samples/OCRHMM_transitions_table.x
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/opencv/opencv_contrib/blob/master/modules/text/samples/webcam_demo.cpp
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/openvinotoolkit/open_model_zoo/blob/master/models/public/yolo-v2-tiny-tf/yolo-v2-
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://github.com/pypa/packagingz
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62433E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/torch/nn/blob/master/doc/module.md
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://gmail.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://gmail.com)u
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://hbo.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://hotmail.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://i.imgur.com/CGxuBuK.png
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://i.imgur.com/CGxuBuK.pngathumbnailaavatar_urluABADD0N
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://i.imgur.com/CGxuBuK.pnguhttps://cdn.discordapp.com/avatars/w/aG3tb1ll1ngaG3tB4dg31aG3tUHQFr1
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://instagram.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://instagram.com)u
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://mahler:8092/site-updates.py
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://minecraft.net)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://netflix.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onnx.ai/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onnx.ai/)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://origin.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://outlook.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://paypal.com)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pjreddie.com/darknet/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pjreddie.com/darknet/)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://playstation.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://pornhub.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://pyopenssl.org/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://pyopenssl.org/a__uri__uPython
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://riotgames.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://riotgames.com)u
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://roblox.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://sellix.io)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://sellix.io)u
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr7
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr7)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://software.intel.com/openvino-toolkit)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://spotify.com)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stat.ethz.ch/~stahel/lognormal/bioscience.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://steam.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://steam.com)u
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://telegram.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://tiktok.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://tiktok.com)u
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://twitch.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://twitter.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://twitter.com)u
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://uber.com)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20090423014010/http://www.brighton-webs.co.uk:80/distributions/wald.asp
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.asp
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.catcert.net/verarrel
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.cazabon.com
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.cazabon.com/pyCMS
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cs.hmc.edu/tr/hmc-cs-2014-0905.pdf
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/dlopen.htm
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/load.htm
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3663.htm
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3666.htm
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdf
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/cornersQualityOOOO
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.littlecms.com
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.openssl.org/docs/manmaster/man5/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.python.org/dev/peps/pep-0506/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.tensorflow.org/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.tensorflow.org/)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.usenix.org/legacy/events/usenix99/provos/provos_html/node4.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://xbox.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://yahoo.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://youtube.com)
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp, localtest.exe, 00000002.00000000.1536156208.00007FF622F3E000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://youtube.com)u
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected Python Keylogger
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe, type: DROPPED
Installs a raw input device (often for capturing keystrokes)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_26e36b7e-7
PE file contains more sections than normal
Source: zlib1.dll.0.dr Static PE information: Number of sections : 12 > 10
Source: libfreetype-6.dll.0.dr Static PE information: Number of sections : 12 > 10
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: Number of sections : 19 > 10
Source: libpng16-16.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: sdl2_image.dll.0.dr Static PE information: Number of sections : 12 > 10
Source: sdl2_ttf.dll.0.dr Static PE information: Number of sections : 12 > 10
Source: libjpeg-9.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: sdl2_mixer.dll.0.dr Static PE information: Number of sections : 12 > 10
Source: cv2.pyd.0.dr Static PE information: Number of sections : 11 > 10
Source: sdl2.dll.0.dr Static PE information: Number of sections : 12 > 10
PE file does not import any functions
Source: python3.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dll^ vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamezlib1.dll* vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesqlite3.dll0 vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamessleay32.dllH vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenametcl86.dllP vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenametk86.dllP vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Widgets.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSDL2.dllR vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSDL_image.dllR vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSDL_mixer.dllR vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSDL_ttf.dllR vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqjpeg.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqsvg.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqtga.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqtiff.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqwbmp.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqwebp.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedsengine.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqtmedia_audioengine.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewmfengine.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqminimal.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqoffscreen.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqwebgl.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqwindows.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewindowsprintersupport.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqsvgicon.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqgif.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqicns.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqico.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000000.1434489470.00007FF65DBBF000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamelocaltest.exe4 vs msupdate.exe
Source: qt5core.dll.0.dr Static PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
Source: classification engine Classification label: mal76.spyw.evad.winEXE@32/508@4/5
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe File created: C:\Users\user\AppData\Roaming\MicrosoftSupport Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6108:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2852:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5708:120:WilError_03
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 Jump to behavior
Source: msupdate.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\msupdate.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: msupdate.exe ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\msupdate.exe File read: C:\Users\user\Desktop\msupdate.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\msupdate.exe "C:\Users\user\Desktop\msupdate.exe"
Source: C:\Users\user\Desktop\msupdate.exe Process created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe "C:\Users\user\Desktop\msupdate.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c mv WindowsSecurityService.exe C:\Users\user\AppData\Roaming\MicrosoftSupport\
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell rm WindowsSecurityService.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell rm WindowsSecurityService.exe
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: unknown Process created: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Process created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Process created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\msupdate.exe Process created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe "C:\Users\user\Desktop\msupdate.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c mv WindowsSecurityService.exe C:\Users\user\AppData\Roaming\MicrosoftSupport\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell rm WindowsSecurityService.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell rm WindowsSecurityService.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Process created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Process created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\msupdate.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: python37.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: python3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: sqlite3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: tcl86t.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: tk86t.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: libopenblas.wcdjnk7yvmpzq2me2zzhjjrj3jikndb7.gfortran-win_amd64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: mf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: mfreadwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: mfcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: ksuser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: sdl2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: sdl2_image.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: libpng16-16.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: libjpeg-9.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: sdl2_ttf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: libfreetype-6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: sdl2_mixer.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: python37.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: python3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: sqlite3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: tcl86t.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: tk86t.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: libopenblas.wcdjnk7yvmpzq2me2zzhjjrj3jikndb7.gfortran-win_amd64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: mf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: mfreadwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: mfcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: ksuser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: sdl2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: sdl2_image.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: libpng16-16.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: libjpeg-9.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: sdl2_ttf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: libfreetype-6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: sdl2_mixer.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: python37.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: python3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: sqlite3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: tcl86t.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: tk86t.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: libopenblas.wcdjnk7yvmpzq2me2zzhjjrj3jikndb7.gfortran-win_amd64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: mf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: mfreadwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: mfcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: ksuser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: sdl2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: sdl2_image.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: libpng16-16.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: libjpeg-9.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: sdl2_ttf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: libfreetype-6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: sdl2_mixer.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: msupdate.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: msupdate.exe Static file information: File size 69484264 > 1048576
Source: msupdate.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: msupdate.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: msupdate.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: msupdate.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: msupdate.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: msupdate.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: msupdate.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: msupdate.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb++ source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qoffscreen.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\dsengine.pdbdd" source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\dsengine.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\unicodedata.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: placed in the .pdbrc file): source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.amd64.pdbGCTL source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbRR source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc) source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: vcruntime140.amd64.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: signToolcAToolsignToolCertcAToolCertISSUER_SIGN_TOOLv2i_issuer_sign_toolcrypto\x509\v3_ist.ci2r_issuer_sign_tool%*ssignTool : %*scATool : %*ssignToolCert: %*scAToolCert : compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: PKCS8_encrypt_excrypto\pkcs12\p12_p8e.cPKCS8_set0_pbe_excrypto\bio\bio_sock.cBIO_sock_initcalling wsastartup()BIO_socket_ioctlcalling ioctlsocket()i2d_ASN1_bio_streamcrypto\asn1\asn_mime.cB64_write_ASN1-----BEGIN %s----- source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bob\openssl-1.0.2s\out32dll\ssleay32.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\printsupport\windowsprintersupport.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qminimal.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\wmfengine.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qoffscreen.pdbKK source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: challengeNETSCAPE_SPKACspkacsig_algorcrypto\bn\bn_exp.cBN_mod_exp_recpBN_mod_exp_mont_wordX509V3_EXT_nconf_intcrypto\x509\v3_conf.csection=%s, name=%s, value=%sdo_ext_nconfname=%s,section=%sdo_ext_i2dX509V3_EXT_i2dcritical,DER:ASN1:v3_generic_extensionvalue=%sX509V3_get_sectioncrypto\x509\v3_lib.cX509V3_add1_i2dcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC3.0.5built on: Tue Jul 5 11:53:43 2022 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot available source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\bob\openssl-1.0.2s\out32dll\ssleay32.pdbFF source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\select.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ~/.pdbrcz source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb11 source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\opencv-python\opencv-python\_skbuild\win-amd64-3.7\cmake-build\lib\python3\Release\cv2.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CCF85000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qminimal.pdbPP source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\cryptography\cryptography\cryptography-37.0.4\src\rust\target\release\deps\cryptography_rust.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5D0719000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\sqlite3.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\wmfengine.pdbLL' source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source: msupdate.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: msupdate.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: msupdate.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: msupdate.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: msupdate.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
Yara detected EXE embedded in BAT file
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe, type: DROPPED
PE file contains sections with non-standard names
Source: msupdate.exe Static PE information: section name: _RDATA
Source: localtest.exe.0.dr Static PE information: section name: _RDATA
Source: qwindows.dll.0.dr Static PE information: section name: .qtmetad
Source: qxdgdesktopportal.dll.0.dr Static PE information: section name: .qtmetad
Source: windowsprintersupport.dll.0.dr Static PE information: section name: .qtmetad
Source: qwindowsvistastyle.dll.0.dr Static PE information: section name: .qtmetad
Source: libcrypto-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: libfreetype-6.dll.0.dr Static PE information: section name: .xdata
Source: libjpeg-9.dll.0.dr Static PE information: section name: .xdata
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: section name: .xdata
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: section name: /4
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: section name: /19
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: section name: /31
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: section name: /45
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: section name: /57
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: section name: /70
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: section name: /81
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr Static PE information: section name: /92
Source: libpng16-16.dll.0.dr Static PE information: section name: .xdata
Source: libssl-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr Static PE information: section name: .didat
Source: qt5core.dll.0.dr Static PE information: section name: .qtmimed
Source: sdl2.dll.0.dr Static PE information: section name: .xdata
Source: sdl2_image.dll.0.dr Static PE information: section name: .xdata
Source: sdl2_mixer.dll.0.dr Static PE information: section name: .xdata
Source: sdl2_ttf.dll.0.dr Static PE information: section name: .xdata
Source: vcruntime140.dll.0.dr Static PE information: section name: _RDATA
Source: zlib1.dll.0.dr Static PE information: section name: .xdata
Source: qsvgicon.dll.0.dr Static PE information: section name: .qtmetad
Source: qgif.dll.0.dr Static PE information: section name: .qtmetad
Source: qicns.dll.0.dr Static PE information: section name: .qtmetad
Source: qico.dll.0.dr Static PE information: section name: .qtmetad
Source: qjpeg.dll.0.dr Static PE information: section name: .qtmetad
Source: qsvg.dll.0.dr Static PE information: section name: .qtmetad
Source: qtga.dll.0.dr Static PE information: section name: .qtmetad
Source: qtiff.dll.0.dr Static PE information: section name: .qtmetad
Source: qwbmp.dll.0.dr Static PE information: section name: .qtmetad
Source: qwebp.dll.0.dr Static PE information: section name: .qtmetad
Source: dsengine.dll.0.dr Static PE information: section name: .qtmetad
Source: qtmedia_audioengine.dll.0.dr Static PE information: section name: .qtmetad
Source: wmfengine.dll.0.dr Static PE information: section name: .qtmetad
Source: qminimal.dll.0.dr Static PE information: section name: .qtmetad
Source: qoffscreen.dll.0.dr Static PE information: section name: .qtmetad
Source: qwebgl.dll.0.dr Static PE information: section name: .qtmetad
Source: cv2.pyd.0.dr Static PE information: section name: IPPCODE
Source: cv2.pyd.0.dr Static PE information: section name: IPPDATA
Source: cv2.pyd.0.dr Static PE information: section name: _RDATA
Source: _portaudio.pyd.0.dr Static PE information: section name: _RDATA
Source: math.pyd.0.dr Static PE information: section name: _RDATA
Drops PE files
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\tk86t.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_sfc64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\rect.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_philox.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\bit_generator.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\display.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_imaging.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\sdl2_mixer.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_mt19937.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\aiohttp\_websocket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\multidict\_multidict.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\surface.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\linalg\_umath_linalg.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\fft\_pocketfft_internal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\libpng16-16.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_imagingft.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\bcrypt\_bcrypt.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\sqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_portaudio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\fft\_pocketfft_internal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\core\_multiarray_umath.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\python37.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5websockets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platforms\qwebgl.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\libfreetype-6.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\cv2\cv2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\QtWidgets.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5websockets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\fft\_pocketfft_internal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5core.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_common.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\python3.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5qmlmodels.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\simplejson\_speedups.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\sdl2.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\image.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\base.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\imageext.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\lz4\block\_block.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5printsupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\bcrypt\_bcrypt.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\mouse.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5qml.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\mediaservice\dsengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\key.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\bufferproxy.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5svg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_cffi_backend.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\display.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_generator.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\vcruntime140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\sdl2.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\mediaservice\dsengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_pcg64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5multimedia.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_lzma.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\frozenlist\_frozenlist.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\mediaservice\wmfengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_pcg64.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\bufferproxy.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_philox.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\joystick.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_bounded_integers.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\font.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\mixer.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\_freetype.pyd Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe File created: C:\Users\user\AppData\Roaming\MicrosoftSupport\WindowsSecurityService.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\core\_multiarray_umath.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\font.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\vcruntime140_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\mediaservice\dsengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5network.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\pixelarray.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\mtrand.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\color.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platforms\qwebgl.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_common.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\time.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\sdl2_ttf.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\cv2\cv2.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\pixelcopy.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\surface.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\yarl\_quoting_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imagingcms.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\tk86t.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_webp.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\event.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\yarl\_quoting_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_helpers.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\rwobject.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\event.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_cffi_backend.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\color.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\zlib1.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\mtrand.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5core.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\regex\_regex.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\_freetype.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\color.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_brotli.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platforms\qoffscreen.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\sdl2_ttf.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_imagingcms.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5printsupport.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imagingft.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platforms\qoffscreen.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5gui.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\transform.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qminimal.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\transform.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\draw.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\tcl86t.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\QtCore.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\aiohttp\_http_parser.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\imageext.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\time.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\math.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_bz2.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\QtCore.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\ssleay32.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\cryptography\hazmat\bindings\_openssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\libfreetype-6.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\sip.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\simplejson\_speedups.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\core\_multiarray_tests.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\mask.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\tcl86t.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5printsupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\sdl2_mixer.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\image.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\ssleay32.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\joystick.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5dbus.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_decimal.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_philox.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\QtGui.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\_freetype.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\sip.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\sdl2_image.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_http_parser.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\rwobject.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\mixer.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5widgets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imagingtk.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qwebgl.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_generator.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\frozenlist\_frozenlist.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\mediaservice\wmfengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\simplejson\_speedups.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5multimedia.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_bounded_integers.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_cffi_backend.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5network.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\sdl2_image.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\cv2\cv2.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\linalg\lapack_lite.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\math.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\mask.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\lz4\block\_block.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_imagingft.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\vcruntime140_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5quick.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\scrap.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\lz4\_version.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_portaudio.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_common.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\zlib1.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\python37.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\QtGui.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5svg.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\aiohttp\_websocket.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\linalg\lapack_lite.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\mediaservice\wmfengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_imagingtk.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\rect.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\core\_multiarray_tests.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\sdl2_mixer.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_imaging.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\joystick.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\key.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\mask.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5network.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\lz4\block\_block.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_portaudio.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\linalg\_umath_linalg.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5widgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\sdl2_image.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\QtWidgets.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libjpeg-9.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\libeay32.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5quick.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_brotli.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5qmlmodels.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_imagingtk.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_webp.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\core\_multiarray_umath.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\bit_generator.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\draw.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\math.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libeay32.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\frozenlist\_frozenlist.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imaging.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\imageext.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\mouse.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qoffscreen.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\cryptography\hazmat\bindings\_openssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\image.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\aiohttp\_helpers.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\scrap.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\QtWidgets.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_http_writer.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5qmlmodels.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\constants.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\mtrand.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\libjpeg-9.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\QtGui.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\libjpeg-9.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\libpng16-16.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\time.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\multidict\_multidict.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\lz4\_version.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5qml.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\bufferproxy.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\constants.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\surflock.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_brotli.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\key.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\pixelarray.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\regex\_regex.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5multimedia.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\yarl\_quoting_c.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_imagingcms.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_pcg64.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5quick.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\event.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\transform.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\bcrypt\_bcrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\tcl86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\linalg\lapack_lite.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\rect.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\rwobject.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\cryptography\hazmat\bindings\_openssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\aiohttp\_http_parser.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\ssleay32.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\python37.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\draw.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5websockets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\pixelcopy.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\aiohttp\_http_writer.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5svg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_ssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_sfc64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\surflock.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\bit_generator.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\QtCore.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_mt19937.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_generator.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\python3.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\display.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5dbus.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\sqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\lz4\_version.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\pixelarray.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platforms\qminimal.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_decimal.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_socket.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_mt19937.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\linalg\_umath_linalg.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\select.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\multidict\_multidict.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\mouse.pyd Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe File created: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5dbus.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\surflock.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\sqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_bounded_integers.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_sfc64.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\tk86t.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\scrap.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\base.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5widgets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_socket.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\mixer.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\sdl2_ttf.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\zlib1.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\aiohttp\_http_writer.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5core.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\font.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\concrt140.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\base.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\sip.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_webp.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_websocket.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\core\_multiarray_tests.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_lzma.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platforms\qminimal.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\aiohttp\_helpers.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\regex\_regex.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\libeay32.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5qml.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libpng16-16.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\pixelcopy.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\sdl2.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libfreetype-6.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\mixer_music.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\constants.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\mixer_music.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\mixer_music.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\surface.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe File created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Jump to behavior
Source: C:\Users\user\Desktop\msupdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\msupdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Window / User API: threadDelayed 1513 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Window / User API: threadDelayed 8452 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5580 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2288 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Window / User API: threadDelayed 6148 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Window / User API: threadDelayed 3816 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Window / User API: threadDelayed 9960 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_sfc64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\rect.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\bit_generator.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_philox.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\display.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_imaging.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_mt19937.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\aiohttp\_websocket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\multidict\_multidict.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\surface.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\linalg\_umath_linalg.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\fft\_pocketfft_internal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_imagingft.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\bcrypt\_bcrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\core\_multiarray_umath.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_portaudio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\fft\_pocketfft_internal.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5websockets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platforms\qwebgl.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\cv2\cv2.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\QtWidgets.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5websockets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\fft\_pocketfft_internal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5core.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_common.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\simplejson\_speedups.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5qmlmodels.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\image.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\base.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\imageext.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\lz4\block\_block.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\bcrypt\_bcrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5printsupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\mouse.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5qml.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\mediaservice\dsengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\key.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\bufferproxy.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5svg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_cffi_backend.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\display.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_generator.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_queue.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\mediaservice\dsengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5multimedia.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_pcg64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_lzma.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\frozenlist\_frozenlist.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\mediaservice\wmfengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_pcg64.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\bufferproxy.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_philox.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\joystick.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_bounded_integers.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\font.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\mixer.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\_freetype.pyd Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\MicrosoftSupport\WindowsSecurityService.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\core\_multiarray_umath.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\font.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\mediaservice\dsengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5network.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\pixelarray.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5gui.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\mtrand.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\color.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platforms\qwebgl.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_common.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\time.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\cv2\cv2.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\pixelcopy.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\yarl\_quoting_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\surface.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imagingcms.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_webp.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\event.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\yarl\_quoting_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\event.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_helpers.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\rwobject.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_cffi_backend.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\color.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\mtrand.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\regex\_regex.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5core.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\_freetype.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\color.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_brotli.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platforms\qoffscreen.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_imagingcms.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5printsupport.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imagingft.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platforms\qoffscreen.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5gui.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\transform.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qminimal.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\transform.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\draw.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\QtCore.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\aiohttp\_http_parser.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\imageext.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\time.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\math.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_bz2.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\QtCore.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\ssleay32.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\cryptography\hazmat\bindings\_openssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\sip.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\simplejson\_speedups.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\core\_multiarray_tests.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\mask.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5printsupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\image.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\ssleay32.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\joystick.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5dbus.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_decimal.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\QtGui.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_philox.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\sip.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\_freetype.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\rwobject.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_http_parser.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\mixer.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5widgets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imagingtk.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qwebgl.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_generator.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\frozenlist\_frozenlist.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\mediaservice\wmfengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\simplejson\_speedups.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5multimedia.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_bounded_integers.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_cffi_backend.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5network.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\cv2\cv2.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\linalg\lapack_lite.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_queue.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\mask.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\math.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\lz4\block\_block.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_imagingft.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_decimal.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5quick.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\scrap.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\lz4\_version.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_portaudio.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_common.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\QtGui.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5svg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\aiohttp\_websocket.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\linalg\lapack_lite.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\mediaservice\wmfengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_imagingtk.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\rect.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\core\_multiarray_tests.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_imaging.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\joystick.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\key.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\mask.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5network.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\lz4\block\_block.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_portaudio.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\linalg\_umath_linalg.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5widgets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\QtWidgets.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\libeay32.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5quick.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_brotli.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5qmlmodels.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_imagingtk.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PIL\_webp.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\core\_multiarray_umath.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\bit_generator.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\draw.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\math.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libeay32.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\frozenlist\_frozenlist.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imaging.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\imageext.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\mouse.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qoffscreen.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\cryptography\hazmat\bindings\_openssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\image.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\aiohttp\_helpers.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\scrap.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\QtWidgets.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_http_writer.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5qmlmodels.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\mtrand.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\constants.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\QtGui.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\time.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\multidict\_multidict.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\lz4\_version.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5qml.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\bufferproxy.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\constants.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\surflock.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_brotli.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\key.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\regex\_regex.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\pixelarray.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5multimedia.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\yarl\_quoting_c.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_pcg64.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_imagingcms.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\event.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5quick.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\transform.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\bcrypt\_bcrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\linalg\lapack_lite.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_ssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\rwobject.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\rect.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\cryptography\hazmat\bindings\_openssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\aiohttp\_http_parser.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\ssleay32.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5websockets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\draw.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\pixelcopy.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\aiohttp\_http_writer.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_ssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5svg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_sfc64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\surflock.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\bit_generator.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\QtCore.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_mt19937.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_generator.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\display.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5dbus.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\lz4\_version.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\pixelarray.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\platforms\qminimal.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_decimal.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\numpy\random\_mt19937.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\linalg\_umath_linalg.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\select.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\multidict\_multidict.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\mouse.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\qt5dbus.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\surflock.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\numpy\random\_bounded_integers.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\random\_sfc64.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\scrap.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\base.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_ssl.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5widgets.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\mixer.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\aiohttp\_http_writer.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\qt5core.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\font.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\concrt140.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\base.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\sip.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PIL\_webp.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_websocket.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_lzma.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\numpy\core\_multiarray_tests.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\platforms\qminimal.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\aiohttp\_helpers.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\regex\_regex.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\libeay32.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\qt5qml.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\pixelcopy.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\mixer_music.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\constants.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\pygame\mixer_music.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\mixer_music.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\pygame\surface.pyd Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\PyQt5\qt-plugins\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\PyQt5\qt-plugins\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\Desktop\msupdate.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_overlapped.pyd Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe TID: 2080 Thread sleep count: 1513 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe TID: 2080 Thread sleep time: -1513000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe TID: 2080 Thread sleep count: 8452 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe TID: 2080 Thread sleep time: -8452000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1736 Thread sleep count: 5580 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1736 Thread sleep count: 2288 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2944 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 500 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe TID: 5240 Thread sleep count: 6148 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe TID: 5240 Thread sleep time: -6148000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe TID: 5240 Thread sleep count: 3816 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe TID: 5240 Thread sleep time: -3816000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe TID: 6136 Thread sleep count: 9960 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe TID: 6136 Thread sleep time: -9960000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Temp\ONEFIL~1\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process token adjusted: Debug Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c mv WindowsSecurityService.exe C:\Users\user\AppData\Roaming\MicrosoftSupport\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell rm WindowsSecurityService.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell rm WindowsSecurityService.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ecb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cbc.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cfb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ofb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ctr.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Util\_strxor.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_BLAKE2s.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_SHA1.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_SHA256.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_MD5.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_Salsa20.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Protocol\_scrypt.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Util\_cpuid_c.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_ghash_portable.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_ghash_clmul.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ocb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aesni.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop\msupdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport\WindowsSecurityService.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop\msupdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop\msupdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop\msupdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\Desktop\msupdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrkflvesgb.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrytzkcpyu.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrlzluscrn.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrvywzldrc.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crpassw.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crpassw.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crcook.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crcook.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ecb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_cbc.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_cfb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ofb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ctr.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Util\_strxor.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_BLAKE2s.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_SHA1.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_SHA256.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_MD5.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_Salsa20.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Protocol\_scrypt.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Util\_cpuid_c.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_ghash_portable.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Hash\_ghash_clmul.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_ocb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_aes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\Crypto\Cipher\_raw_aesni.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport\WindowsSecurityService.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrcwblpieb.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrupbdtldh.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrbsxvgjoy.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrteoxnopv.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crcook.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crpassw.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crpassw.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crcook.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ecb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_cbc.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_cfb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ofb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ctr.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Util\_strxor.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_BLAKE2s.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_SHA1.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_SHA256.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_MD5.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_Salsa20.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Protocol\_scrypt.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Util\_cpuid_c.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_ghash_portable.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Hash\_ghash_clmul.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_ocb.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_aes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\Crypto\Cipher\_raw_aesni.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport\WindowsSecurityService.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrsmbeiqng.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrypoytydq.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crpassw.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crpassw.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcruvhdtnrp.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Tempcrouutfgon.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crcook.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\crcook.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\certifi\cacert.pem VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1467960 Sample: msupdate.exe Startdate: 05/07/2024 Architecture: WINDOWS Score: 76 81 geolocation-db.com 2->81 83 discord.com 2->83 85 2 other IPs or domains 2->85 91 Multi AV Scanner detection for submitted file 2->91 93 Yara detected Python Keylogger 2->93 95 AI detected suspicious sample 2->95 97 Yara detected EXE embedded in BAT file 2->97 9 msupdate.exe 220 2->9         started        12 MicrosoftSecurityUpdate.exe 220 2->12         started        14 MicrosoftSecurityUpdate.exe 220 2->14         started        signatures3 99 Tries to detect the country of the analysis system (by using the IP) 81->99 process4 file5 57 C:\Users\user\AppData\Local\...\localtest.exe, PE32+ 9->57 dropped 69 160 other files (none is malicious) 9->69 dropped 16 localtest.exe 1 9 9->16         started        59 C:\Users\user\AppData\Local\...\localtest.exe, PE32+ 12->59 dropped 61 C:\Users\user\AppData\Local\...\zlib1.dll, PE32+ 12->61 dropped 63 C:\Users\user\AppData\...\_quoting_c.pyd, PE32+ 12->63 dropped 71 158 other files (none is malicious) 12->71 dropped 21 localtest.exe 4 12->21         started        65 C:\Users\user\AppData\Local\...\localtest.exe, PE32+ 14->65 dropped 67 C:\Users\user\AppData\Local\...\zlib1.dll, PE32+ 14->67 dropped 73 159 other files (none is malicious) 14->73 dropped 23 localtest.exe 4 14->23         started        process6 dnsIp7 75 geolocation-db.com 159.89.102.253, 443, 49711, 49713 DIGITALOCEAN-ASNUS United States 16->75 77 121.127.33.39, 49723, 49724, 49725 RANATECHNET-AFRANATechnologiesKabulAF Afghanistan 16->77 79 3 other IPs or domains 16->79 53 C:\Users\user\...\WindowsSecurityService.exe, PE32+ 16->53 dropped 55 C:\Users\user\...\MicrosoftSecurityUpdate.exe, PE32+ 16->55 dropped 87 Tries to steal Crypto Currency Wallets 16->87 25 cmd.exe 1 16->25         started        27 cmd.exe 1 16->27         started        29 cmd.exe 1 16->29         started        89 Tries to harvest and steal browser information (history, passwords, etc) 21->89 31 cmd.exe 21->31         started        33 cmd.exe 23->33         started        file8 signatures9 process10 process11 35 powershell.exe 11 25->35         started        37 conhost.exe 25->37         started        39 conhost.exe 27->39         started        41 tasklist.exe 1 27->41         started        43 conhost.exe 29->43         started        45 conhost.exe 31->45         started        47 tasklist.exe 1 31->47         started        49 conhost.exe 33->49         started        51 tasklist.exe 1 33->51         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
121.127.33.39
 unknown Afghanistan
55732 RANATECHNET-AFRANATechnologiesKabulAF false
162.159.137.232
 discord.com United States
13335 CLOUDFLARENETUS false
151.80.29.83
 api.gofile.io Italy
16276 OVHFR false
159.89.102.253
 geolocation-db.com United States
14061 DIGITALOCEAN-ASNUS true
172.67.74.152
 api.ipify.org United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
discord.com 162.159.137.232 true
api.ipify.org 172.67.74.152 true
geolocation-db.com 159.89.102.253 true
api.gofile.io 151.80.29.83 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
  • URL Reputation: safe
 unknown