Windows Analysis Report
user.exe

Overview

General Information

Sample name: user.exe
Analysis ID: 1579342
MD5: 9ac651562b490c1651fdd79149040bf8
SHA1: fc17e22b0f17755ee5a665c0dc4d128e4eb6d8c2
SHA256: c414aac5e5b64da60d998f5d82d3233204ddbe02981b8734fca6dd0b56f691cf
Tags: exeuser-aachum
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found pyInstaller with non standard icon
Uses the Telegram API (likely for C&C communication)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect virtual machines (SGDT)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: user.exe Virustotal: Detection: 12% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 98.3% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA360A3D0 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA360A3D0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA36043C0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug, 2_2_00007FFDA36043C0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1D93 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free, 2_2_00007FFDA35A1D93
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F8390 CRYPTO_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35F8390
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B2360 CRYPTO_THREAD_run_once, 2_2_00007FFDA35B2360
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock, 2_2_00007FFDA35A198D
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35BE427 CRYPTO_THREAD_write_lock, 2_2_00007FFDA35BE427
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A23DD EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug, 2_2_00007FFDA35A23DD
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C2410 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data, 2_2_00007FFDA35C2410
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1B31
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3600330 CRYPTO_free,CRYPTO_strndup, 2_2_00007FFDA3600330
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A4300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A4300
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EE190 CRYPTO_free, 2_2_00007FFDA35EE190
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A15E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A15E6
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1F55 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock, 2_2_00007FFDA35A1F55
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1389 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A1389
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EE200 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35EE200
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F80C0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35F80C0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C20A0 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock, 2_2_00007FFDA35C20A0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA36000A0 CRYPTO_free,CRYPTO_memdup, 2_2_00007FFDA36000A0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35AE0AD ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new, 2_2_00007FFDA35AE0AD
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35BC080 CRYPTO_free,CRYPTO_memdup, 2_2_00007FFDA35BC080
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2527 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A2527
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A19DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup, 2_2_00007FFDA35A19DD
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A4100 CRYPTO_free, 2_2_00007FFDA35A4100
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free, 2_2_00007FFDA35A1361
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1F28 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup, 2_2_00007FFDA35A1F28
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A1401
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EE781 CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35EE781
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2423 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A2423
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1F3C CRYPTO_malloc,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1F3C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1CA3 CRYPTO_strdup,CRYPTO_free, 2_2_00007FFDA35A1CA3
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A25F4 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free, 2_2_00007FFDA35A25F4
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35BA6D0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free, 2_2_00007FFDA35BA6D0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E26B0 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free, 2_2_00007FFDA35E26B0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free, 2_2_00007FFDA35A162C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E4660 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug, 2_2_00007FFDA35E4660
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A16A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A16A4
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A103C CRYPTO_malloc,COMP_expand_block, 2_2_00007FFDA35A103C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EE700 CRYPTO_free, 2_2_00007FFDA35EE700
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A120D EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset, 2_2_00007FFDA35A120D
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A85A0 CRYPTO_zalloc,CRYPTO_free, 2_2_00007FFDA35A85A0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A1488
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A13D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free, 2_2_00007FFDA35A13D9
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1212 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free, 2_2_00007FFDA35A1212
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3606650 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free, 2_2_00007FFDA3606650
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F8620 CRYPTO_memcmp, 2_2_00007FFDA35F8620
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A24CD CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy, 2_2_00007FFDA35A24CD
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C05E0 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free, 2_2_00007FFDA35C05E0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A26E4 BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free, 2_2_00007FFDA35A26E4
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A18B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A18B6
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35D4490 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35D4490
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock, 2_2_00007FFDA35A1AC3
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3616550 CRYPTO_memcmp, 2_2_00007FFDA3616550
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B4530 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free, 2_2_00007FFDA35B4530
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A1ACD
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1A0F
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3604C40 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free, 2_2_00007FFDA3604C40
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A4C00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A4C00
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EEC10 CRYPTO_free, 2_2_00007FFDA35EEC10
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1AB4
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A114F CRYPTO_free,ERR_new,ERR_set_debug, 2_2_00007FFDA35A114F
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35BEB48 CRYPTO_free, 2_2_00007FFDA35BEB48
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1460 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf, 2_2_00007FFDA35A1460
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B6B20 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags, 2_2_00007FFDA35B6B20
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A4B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A4B30
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35CEB10 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock, 2_2_00007FFDA35CEB10
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A204F CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug, 2_2_00007FFDA35A204F
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A17DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A17DF
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1893
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B4990 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35B4990
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2185 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug, 2_2_00007FFDA35A2185
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free, 2_2_00007FFDA35A1A05
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A1492
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E2A50 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free, 2_2_00007FFDA35E2A50
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A24EB CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug, 2_2_00007FFDA35A24EB
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F89F0 CRYPTO_free,CRYPTO_memdup, 2_2_00007FFDA35F89F0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A26B2 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup, 2_2_00007FFDA35A26B2
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EE8C0 CRYPTO_free, 2_2_00007FFDA35EE8C0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3618870 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA3618870
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3604860 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free, 2_2_00007FFDA3604860
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1EE2 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1EE2
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EE920 CRYPTO_free, 2_2_00007FFDA35EE920
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B4930 CRYPTO_get_ex_new_index, 2_2_00007FFDA35B4930
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock, 2_2_00007FFDA35A139D
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA361A8F0 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free, 2_2_00007FFDA361A8F0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA360C8E0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA360C8E0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A4FD0 CRYPTO_free, 2_2_00007FFDA35A4FD0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A20E5 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A20E5
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2144 EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug, 2_2_00007FFDA35A2144
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2117 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug, 2_2_00007FFDA35A2117
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35ACEA0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free, 2_2_00007FFDA35ACEA0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A17E9 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_new,ERR_set_debug, 2_2_00007FFDA35A17E9
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E8E90 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug, 2_2_00007FFDA35E8E90
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A117C _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock, 2_2_00007FFDA35A117C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A236A CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A236A
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3612EE0 CRYPTO_memcmp, 2_2_00007FFDA3612EE0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35BEDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free, 2_2_00007FFDA35BEDC1
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1771 CRYPTO_free, 2_2_00007FFDA35A1771
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A222F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free, 2_2_00007FFDA35A222F
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcmp,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free, 2_2_00007FFDA35A1B54
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35BEDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free, 2_2_00007FFDA35BEDC1
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free, 2_2_00007FFDA35A1811
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F8CA0 CRYPTO_free,CRYPTO_strndup, 2_2_00007FFDA35F8CA0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A257C ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse, 2_2_00007FFDA35A257C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E8C80 CRYPTO_free, 2_2_00007FFDA35E8C80
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A22D9 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A22D9
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EEC70 CRYPTO_free, 2_2_00007FFDA35EEC70
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E8D40 OPENSSL_cleanse,CRYPTO_free, 2_2_00007FFDA35E8D40
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1CBC
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35BCD30 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35BCD30
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A136B
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35AD3CA CRYPTO_free, 2_2_00007FFDA35AD3CA
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1444 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy, 2_2_00007FFDA35A1444
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA361B430 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free, 2_2_00007FFDA361B430
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free, 2_2_00007FFDA35A1997
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1A32
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free, 2_2_00007FFDA35A195B
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1F8C CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1F8C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3613260 CRYPTO_free,CRYPTO_memdup, 2_2_00007FFDA3613260
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup, 2_2_00007FFDA35A111D
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35AB300 CRYPTO_clear_free, 2_2_00007FFDA35AB300
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A17F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A17F8
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock, 2_2_00007FFDA35A1677
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35D92E0 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35D92E0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35AF160 CRYPTO_free,CRYPTO_memdup, 2_2_00007FFDA35AF160
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3601170 ERR_new,ERR_set_debug,CRYPTO_clear_free, 2_2_00007FFDA3601170
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35CD170 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free, 2_2_00007FFDA35CD170
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free, 2_2_00007FFDA35A1B90
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free, 2_2_00007FFDA35A1262
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35AD227 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35AD227
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3607230 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free, 2_2_00007FFDA3607230
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free, 2_2_00007FFDA35A1A23
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2374 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A2374
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35D50D8 EVP_MAC_CTX_free,CRYPTO_free, 2_2_00007FFDA35D50D8
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A14CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug, 2_2_00007FFDA35A14CE
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E30A0 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free, 2_2_00007FFDA35E30A0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A21DF CRYPTO_memcmp, 2_2_00007FFDA35A21DF
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C9080 CRYPTO_free,EVP_PKEY_free,CRYPTO_free, 2_2_00007FFDA35C9080
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA361B070 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA361B070
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3605070 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA3605070
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35CF070 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,memcpy, 2_2_00007FFDA35CF070
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E9120 CRYPTO_malloc,ERR_new,ERR_set_debug, 2_2_00007FFDA35E9120
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A11A9 EVP_MAC_CTX_free,CRYPTO_free, 2_2_00007FFDA35A11A9
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA36017A1 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug, 2_2_00007FFDA36017A1
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F77A0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35F77A0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A11BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A11BD
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B7840 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free, 2_2_00007FFDA35B7840
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once, 2_2_00007FFDA35A1087
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA36157FE CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA36157FE
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E56D0 CRYPTO_free, 2_2_00007FFDA35E56D0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A12CB CRYPTO_THREAD_run_once, 2_2_00007FFDA35A12CB
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA360B660 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free, 2_2_00007FFDA360B660
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F1750 CRYPTO_free,CRYPTO_memdup, 2_2_00007FFDA35F1750
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A1023
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2469 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A2469
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A21E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug, 2_2_00007FFDA35A21E9
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A20F4 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A20F4
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F7570 CRYPTO_realloc, 2_2_00007FFDA35F7570
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3613650 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free, 2_2_00007FFDA3613650
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35AF650 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug, 2_2_00007FFDA35AF650
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B1620 CRYPTO_free,CRYPTO_strndup, 2_2_00007FFDA35B1620
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A110E EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free, 2_2_00007FFDA35A110E
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1181 CRYPTO_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A1181
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2379 CRYPTO_free, 2_2_00007FFDA35A2379
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1EDD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A1EDD
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1393 OSSL_PROVIDER_do_all,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy, 2_2_00007FFDA35A1393
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3613480 CRYPTO_free,CRYPTO_strndup, 2_2_00007FFDA3613480
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2126 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A2126
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35A193D
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35CD510 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free, 2_2_00007FFDA35CD510
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F14E0 CRYPTO_memcmp, 2_2_00007FFDA35F14E0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1992
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3601B9F CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free, 2_2_00007FFDA3601B9F
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35CDBA0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free, 2_2_00007FFDA35CDBA0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B5BB0 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort, 2_2_00007FFDA35B5BB0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C5B90 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35C5B90
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA361BB70 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug, 2_2_00007FFDA361BB70
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A19E7 CRYPTO_free, 2_2_00007FFDA35A19E7
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1483
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free, 2_2_00007FFDA35A1582
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug, 2_2_00007FFDA35A155A
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B7A60 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free, 2_2_00007FFDA35B7A60
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3603A60 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free, 2_2_00007FFDA3603A60
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E9A60 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free, 2_2_00007FFDA35E9A60
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EFB00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug, 2_2_00007FFDA35EFB00
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35CFAF0 CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup, 2_2_00007FFDA35CFAF0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A11DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free, 2_2_00007FFDA35A11DB
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free, 2_2_00007FFDA35A105F
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35ED980 RAND_bytes_ex,CRYPTO_malloc,memset, 2_2_00007FFDA35ED980
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35F1970 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free, 2_2_00007FFDA35F1970
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA360BA20 CRYPTO_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA360BA20
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E3A00 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35E3A00
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1A15 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock, 2_2_00007FFDA35A1A15
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1A41 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1A41
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A13DE EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A13DE
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35D38C0 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35D38C0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A589C BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init, 2_2_00007FFDA35A589C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B9870 CRYPTO_free,CRYPTO_strdup, 2_2_00007FFDA35B9870
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1E6A ERR_new,ERR_set_debug,CRYPTO_clear_free, 2_2_00007FFDA35A1E6A
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA361B900 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA361B900
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35AF910 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free, 2_2_00007FFDA35AF910
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1654 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,ERR_new,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free, 2_2_00007FFDA35A1654
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35ADFB5 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35ADFB5
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new, 2_2_00007FFDA35A1B18
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A23EC CRYPTO_free,CRYPTO_memdup, 2_2_00007FFDA35A23EC
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A202C CRYPTO_free, 2_2_00007FFDA35A202C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C6030 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35C6030
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1019 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug, 2_2_00007FFDA35A1019
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A107D CRYPTO_free, 2_2_00007FFDA35A107D
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A3EB0 CRYPTO_free, 2_2_00007FFDA35A3EB0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A25DB CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug, 2_2_00007FFDA35A25DB
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A150F OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup, 2_2_00007FFDA35A150F
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2720 CRYPTO_free,CRYPTO_strdup, 2_2_00007FFDA35A2720
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA360DF40 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy, 2_2_00007FFDA360DF40
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B5F20 CRYPTO_THREAD_run_once, 2_2_00007FFDA35B5F20
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1C53 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free, 2_2_00007FFDA35A1C53
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35BBF30 CRYPTO_memcmp, 2_2_00007FFDA35BBF30
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3603F30 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free, 2_2_00007FFDA3603F30
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2680 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock, 2_2_00007FFDA35A2680
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A5EE0 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free, 2_2_00007FFDA35A5EE0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1D89 CRYPTO_free,CRYPTO_memdup, 2_2_00007FFDA35A1D89
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA360BE20 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA360BE20
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2310 ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free, 2_2_00007FFDA35A2310
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C5E10 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error, 2_2_00007FFDA35C5E10
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A108C ERR_new,ERR_set_debug,CRYPTO_free, 2_2_00007FFDA35A108C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B3CC0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free, 2_2_00007FFDA35B3CC0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A23F1 CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35A23F1
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35B5CB0 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort, 2_2_00007FFDA35B5CB0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A5C9B CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags, 2_2_00007FFDA35A5C9B
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C5D20 CRYPTO_free,CRYPTO_free, 2_2_00007FFDA35C5D20
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1CEE CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse, 2_2_00007FFDA35A1CEE
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3603D20 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free, 2_2_00007FFDA3603D20
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2595 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free, 2_2_00007FFDA35A2595
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA36753DC ASN1_STRING_type,ASN1_STRING_length,ASN1_STRING_get0_data,Py_BuildValue,ASN1_STRING_to_UTF8,_Py_Dealloc,Py_BuildValue,CRYPTO_free, 2_2_00007FFDA36753DC
Source: user.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3411011151.00007FFD93D57000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: user.exe, 00000002.00000002.3411559326.00007FFD941AA000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\_win32sysloader.pdb source: user.exe, 00000000.00000003.2148730570.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, _win32sysloader.pyd.0.dr
Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: user.exe, 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: user.exe, 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413952189.00007FFDA4634000.00000002.00000001.01000000.00000015.sdmp, _wmi.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source: Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: _rust.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb}},GCTL source: user.exe, 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmp, pythoncom313.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32trace.pdb source: user.exe, 00000000.00000003.2149332664.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\user\tb_digest.cuser_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: _rust.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414197760.00007FFDA5474000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: user.exe, 00000002.00000002.3411559326.00007FFD94112000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414197760.00007FFDA5474000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb!! source: user.exe, 00000002.00000002.3412855086.00007FFD9F3D3000.00000002.00000001.01000000.00000019.sdmp, win32api.pyd.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: user.exe, 00000002.00000002.3411559326.00007FFD941AA000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb source: user.exe, 00000002.00000002.3412855086.00007FFD9F3D3000.00000002.00000001.01000000.00000019.sdmp, win32api.pyd.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: _rust.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413689442.00007FFDA3FD5000.00000002.00000001.01000000.00000016.sdmp, VCRUNTIME140_1.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414439896.00007FFDA54B3000.00000002.00000001.01000000.0000000C.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: user.exe, 00000002.00000002.3413597400.00007FFDA36E3000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: user.exe, 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414328389.00007FFDA5496000.00000002.00000001.01000000.00000010.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413478524.00007FFDA36BB000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414106726.00007FFDA4DA3000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb source: user.exe, 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmp, pythoncom313.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413478524.00007FFDA36BB000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413866301.00007FFDA433D000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413952189.00007FFDA4634000.00000002.00000001.01000000.00000015.sdmp, _wmi.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413777754.00007FFDA4169000.00000002.00000001.01000000.0000000B.sdmp, _socket.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408463161.000001F8471B0000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: user.exe, 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413689442.00007FFDA3FD5000.00000002.00000001.01000000.00000016.sdmp, VCRUNTIME140_1.dll.0.dr
Source: Binary string: D:\a\1\b\libssl-3.pdb source: user.exe, 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: user.exe, 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmp, _ssl.pyd.0.dr
Creates COM task schedule object (often to register a task for autostart)
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715759280 FindFirstFileExW,FindClose, 0_2_00007FF715759280
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715771874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF7157583C0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715759280 FindFirstFileExW,FindClose, 2_2_00007FF715759280
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715771874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF7157583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 2_2_00007FF7157583C0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C3540 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc, 2_2_00007FFD9F3C3540
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C53D0 PyArg_ParseTuple,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z, 2_2_00007FFD9F3C53D0

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.../back.jpeg
Source: user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digi
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlI
Source: user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlh
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlR
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: libcrypto-3.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: user.exe, 00000002.00000002.3409847357.000001F8481A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160160747.000001F847D8F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: user.exe, 00000002.00000002.3408755287.000001F847852000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160740290.000001F84786A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8477E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es0
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.est
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/L
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es00
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps
Source: user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wwwsearch.sf.net/):
Source: user.exe, 00000002.00000002.3409026139.000001F847990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410407213.000001F848D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot8198088572:AAHwnTyia_2pAX94h0pkYLAjGks3YjPwP0M/sendMessage
Source: _cffi_backend.cp313-win_amd64.pyd.0.dr String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: _rust.pyd.0.dr String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/security/
Source: user.exe, 00000002.00000003.2158458420.000001F847826000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8477E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: user.exe, 00000002.00000002.3408674360.000001F847590000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: user.exe, 00000002.00000002.3408336405.000001F847124000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: user.exe, 00000002.00000002.3408336405.000001F847124000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F8483D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: user.exe, 00000002.00000002.3409026139.000001F847990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: user.exe, 00000002.00000003.2160391877.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: user.exe, 00000002.00000002.3410228590.000001F848C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: user.exe, user.exe, 00000002.00000002.3412888104.00007FFD9F3E1000.00000002.00000001.01000000.00000019.sdmp, user.exe, 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmp, user.exe, 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmp, win32api.pyd.0.dr, pythoncom313.dll.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.dr, _win32sysloader.pyd.0.dr String found in binary or memory: https://github.com/mhammond/pywin32
Source: user.exe, 00000002.00000002.3410228590.000001F848BDC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr, _rust.pyd.0.dr String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: _rust.pyd.0.dr String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: _rust.pyd.0.dr String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: user.exe, 00000002.00000002.3408336405.000001F847124000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: user.exe, 00000002.00000003.2157638573.000001F8477A6000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157728627.000001F8477B8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157877021.000001F847795000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: user.exe, 00000002.00000002.3409026139.000001F847990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: user.exe, 00000002.00000002.3408755287.000001F847690000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: user.exe, 00000002.00000002.3408755287.000001F847690000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail/
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/
Source: user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160667306.000001F848405000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/get
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157425379.000001F847765000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/post
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160160747.000001F847D8F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mahler:8092/site-updates.py
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: user.exe, 00000002.00000002.3409687341.000001F847F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
Source: user.exe, 00000002.00000002.3408755287.000001F847852000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: user.exe, 00000002.00000002.3408755287.000001F847852000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: user.exe, 00000002.00000002.3409687341.000001F847F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: user.exe, 00000002.00000002.3408948014.000001F847890000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F84770C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2152930488.000001F845809000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr String found in binary or memory: https://peps.python.org/pep-0205/
Source: user.exe, 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://peps.python.org/pep-0263/
Source: user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://pypi.org/project/cryptography/
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157425379.000001F847765000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://requests.readthedocs.io
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F8477A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: user.exe, 00000002.00000002.3409105783.000001F847A90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: user.exe, 00000000.00000003.2135434533.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr String found in binary or memory: https://www.apache.org/licenses/
Source: user.exe, 00000000.00000003.2135511446.000001E955DF2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2135434533.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2135390455.000001E955DF2000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmp, user.exe, 00000002.00000002.3411790282.00007FFD94254000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr String found in binary or memory: https://www.openssl.org/H
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157425379.000001F847765000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.python.org
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160160747.000001F847D8F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/
Source: user.exe, 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.python.org/psf/license/)
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8477E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C4F70 PyArg_ParseTuple,PyEval_SaveThread,GetKeyboardState,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize, 2_2_00007FFD9F3C4F70
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C5980 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct, 2_2_00007FFD9F3C5980
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C58E0 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct, 2_2_00007FFD9F3C58E0
Detected potential crypto function
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157708C8 0_2_00007FF7157708C8
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715751000 0_2_00007FF715751000
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157589E0 0_2_00007FF7157589E0
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715776964 0_2_00007FF715776964
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715775C00 0_2_00007FF715775C00
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715769EA0 0_2_00007FF715769EA0
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71576DEF0 0_2_00007FF71576DEF0
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715775E7C 0_2_00007FF715775E7C
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157635A0 0_2_00007FF7157635A0
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715765D30 0_2_00007FF715765D30
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715761D54 0_2_00007FF715761D54
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71576E570 0_2_00007FF71576E570
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157740AC 0_2_00007FF7157740AC
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157680E4 0_2_00007FF7157680E4
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715771874 0_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715759800 0_2_00007FF715759800
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715779728 0_2_00007FF715779728
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715761740 0_2_00007FF715761740
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715761F60 0_2_00007FF715761F60
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715768794 0_2_00007FF715768794
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71575A2DB 0_2_00007FF71575A2DB
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71576DA5C 0_2_00007FF71576DA5C
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157639A4 0_2_00007FF7157639A4
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715761944 0_2_00007FF715761944
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715762164 0_2_00007FF715762164
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71575ACAD 0_2_00007FF71575ACAD
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715776418 0_2_00007FF715776418
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157708C8 0_2_00007FF7157708C8
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71575A474 0_2_00007FF71575A474
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715762C10 0_2_00007FF715762C10
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715773C10 0_2_00007FF715773C10
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715761B50 0_2_00007FF715761B50
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715751000 2_2_00007FF715751000
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715776964 2_2_00007FF715776964
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715769EA0 2_2_00007FF715769EA0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71576DEF0 2_2_00007FF71576DEF0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715775E7C 2_2_00007FF715775E7C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF7157635A0 2_2_00007FF7157635A0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715765D30 2_2_00007FF715765D30
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715761D54 2_2_00007FF715761D54
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71576E570 2_2_00007FF71576E570
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF7157740AC 2_2_00007FF7157740AC
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF7157708C8 2_2_00007FF7157708C8
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF7157680E4 2_2_00007FF7157680E4
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715771874 2_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715759800 2_2_00007FF715759800
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715779728 2_2_00007FF715779728
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715761740 2_2_00007FF715761740
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715761F60 2_2_00007FF715761F60
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715768794 2_2_00007FF715768794
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71575A2DB 2_2_00007FF71575A2DB
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71576DA5C 2_2_00007FF71576DA5C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF7157639A4 2_2_00007FF7157639A4
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF7157589E0 2_2_00007FF7157589E0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715761944 2_2_00007FF715761944
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715762164 2_2_00007FF715762164
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71575ACAD 2_2_00007FF71575ACAD
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715776418 2_2_00007FF715776418
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF7157708C8 2_2_00007FF7157708C8
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71575A474 2_2_00007FF71575A474
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715775C00 2_2_00007FF715775C00
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715762C10 2_2_00007FF715762C10
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715773C10 2_2_00007FF715773C10
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715761B50 2_2_00007FF715761B50
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C08A30 2_2_00007FFD93C08A30
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C23230 2_2_00007FFD93C23230
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C23780 2_2_00007FFD93C23780
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C2F690 2_2_00007FFD93C2F690
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C1DA90 2_2_00007FFD93C1DA90
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C31FC0 2_2_00007FFD93C31FC0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C32300 2_2_00007FFD93C32300
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C085E0 2_2_00007FFD93C085E0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93BF8550 2_2_00007FFD93BF8550
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C384A0 2_2_00007FFD93C384A0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C1CB70 2_2_00007FFD93C1CB70
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C1A880 2_2_00007FFD93C1A880
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C2ECC0 2_2_00007FFD93C2ECC0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93CB1300 2_2_00007FFD93CB1300
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93CB2270 2_2_00007FFD93CB2270
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93CB1950 2_2_00007FFD93CB1950
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C43F0 2_2_00007FFD9F3C43F0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C3930 2_2_00007FFD9F3C3930
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C3540 2_2_00007FFD9F3C3540
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA357C840 2_2_00007FFDA357C840
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3573A50 2_2_00007FFDA3573A50
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35810A0 2_2_00007FFDA35810A0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1D93 2_2_00007FFDA35A1D93
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A116D 2_2_00007FFDA35A116D
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A8720 2_2_00007FFDA35A8720
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A16FE 2_2_00007FFDA35A16FE
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2617 2_2_00007FFDA35A2617
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1A0F 2_2_00007FFDA35A1A0F
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1618 2_2_00007FFDA35A1618
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3618870 2_2_00007FFDA3618870
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1EE2 2_2_00007FFDA35A1EE2
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35D8920 2_2_00007FFDA35D8920
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A117C 2_2_00007FFDA35A117C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1B54 2_2_00007FFDA35A1B54
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA361AC80 2_2_00007FFDA361AC80
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1CBC 2_2_00007FFDA35A1CBC
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A149C 2_2_00007FFDA35A149C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA360D2D0 2_2_00007FFDA360D2D0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A17F8 2_2_00007FFDA35A17F8
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A24DC 2_2_00007FFDA35A24DC
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A2702 2_2_00007FFDA35A2702
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3613650 2_2_00007FFDA3613650
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1C12 2_2_00007FFDA35A1C12
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E5C00 2_2_00007FFDA35E5C00
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A155A 2_2_00007FFDA35A155A
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E9A60 2_2_00007FFDA35E9A60
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35CBAE0 2_2_00007FFDA35CBAE0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35ED980 2_2_00007FFDA35ED980
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1596 2_2_00007FFDA35A1596
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A13DE 2_2_00007FFDA35A13DE
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A21C6 2_2_00007FFDA35A21C6
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1654 2_2_00007FFDA35A1654
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C6030 2_2_00007FFDA35C6030
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1AD7 2_2_00007FFDA35A1AD7
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1546 2_2_00007FFDA35A1546
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A21E4 2_2_00007FFDA35A21E4
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35EDE50 2_2_00007FFDA35EDE50
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A1FDC 2_2_00007FFDA35A1FDC
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA367BF74 2_2_00007FFDA367BF74
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3678734 2_2_00007FFDA3678734
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFDA361D32F appears 327 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFDA361DB03 appears 45 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFDA3573900 appears 116 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFDA361D33B appears 43 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFD93BF4250 appears 68 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FF715752910 appears 34 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFDA361D341 appears 1193 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFD93BF4BF0 appears 77 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFDA354C400 appears 47 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFDA35A1325 appears 471 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFDA361D425 appears 48 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFDA3573880 appears 51 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FF715752710 appears 104 times
Source: C:\Users\user\Desktop\user.exe Code function: String function: 00007FFD93C089C0 appears 248 times
PE file contains executable resources (Code or Archives)
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file does not import any functions
Source: python3.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2131357059.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewin32ui.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs user.exe
Source: user.exe, 00000000.00000002.3408114084.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2149332664.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibsslH vs user.exe
Source: user.exe, 00000000.00000003.2148730570.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_wmi.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2144073335.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepythoncom313.dll0 vs user.exe
Source: user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs user.exe
Source: user.exe, 00000000.00000003.2149198471.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewin32api.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2149332664.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2145628033.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepywintypes313.dll0 vs user.exe
Source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs user.exe
Source: user.exe Binary or memory string: OriginalFilename vs user.exe
Source: user.exe, 00000002.00000002.3412791318.00007FFD948B0000.00000002.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenamepython313.dll. vs user.exe
Source: user.exe, 00000002.00000002.3414475344.00007FFDA54B6000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3413985072.00007FFDA4638000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: OriginalFilename_wmi.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3412888104.00007FFD9F3E1000.00000002.00000001.01000000.00000019.sdmp Binary or memory string: OriginalFilenamewin32api.pyd0 vs user.exe
Source: user.exe, 00000002.00000002.3413535138.00007FFDA36C3000.00000002.00000001.01000000.0000000A.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3414256126.00007FFDA547A000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs user.exe
Source: user.exe, 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3413724236.00007FFDA3FD9000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs user.exe
Source: user.exe, 00000002.00000002.3411138623.00007FFD93D5C000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3413812063.00007FFDA4173000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3414141756.00007FFDA4DA6000.00000002.00000001.01000000.00000011.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmp Binary or memory string: OriginalFilenamepywintypes313.dll0 vs user.exe
Source: user.exe, 00000002.00000002.3408463161.000001F8471B0000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs user.exe
Source: user.exe, 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilenamelibsslH vs user.exe
Source: user.exe, 00000002.00000002.3414375655.00007FFDA549D000.00000002.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3413635140.00007FFDA36EE000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmp Binary or memory string: OriginalFilenamepythoncom313.dll0 vs user.exe
Source: user.exe, 00000002.00000002.3413901141.00007FFDA4342000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3411790282.00007FFD94254000.00000002.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs user.exe
Source: classification engine Classification label: mal60.troj.evad.winEXE@3/41@1/1
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C3930 PyArg_ParseTuple,GetLastError,?PyWin_GetErrorMessageModule@@YAPEAUHINSTANCE__@@K@Z,FormatMessageW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,PyErr_Clear,PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,?PyWinSequence_Tuple@@YAPEAU_object@@PEAU1@PEAK@Z,malloc,PyErr_NoMemory,memset,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,FormatMessageW,PyEval_RestoreThread,PyExc_SystemError,PyErr_SetString,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,free,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,LocalFree,_Py_Dealloc, 2_2_00007FFD9F3C3930
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C4C00 _Py_NoneStruct,PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,GetDiskFreeSpaceW,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,Py_BuildValue, 2_2_00007FFD9F3C4C00
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C01330 PyArg_ParseTuple,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,PyObject_IsInstance,PyErr_Occurred,PyExc_TypeError,PyErr_SetString,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_GetAttrString,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,_Py_Dealloc,PyEval_SaveThread,CoCreateInstance,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass, 2_2_00007FFD93C01330
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3CCBB0 PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,FindResourceExW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,SizeofResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LoadResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LockResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,?PyWinObject_FreeResourceId@@YAXPEA_W@Z,?PyWinObject_FreeResourceId@@YAXPEA_W@Z, 2_2_00007FFD9F3CCBB0
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\Desktop\errors.log Jump to behavior
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482 Jump to behavior
Source: user.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\user.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Users\user\Desktop\user.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: user.exe Virustotal: Detection: 12%
Source: C:\Users\user\Desktop\user.exe File read: C:\Users\user\Desktop\user.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"
Source: C:\Users\user\Desktop\user.exe Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"
Source: C:\Users\user\Desktop\user.exe Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe" Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: libffi-8.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: libcrypto-3.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: libssl-3.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\user.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: user.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: user.exe Static file information: File size 15746174 > 1048576
Source: user.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: user.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: user.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: user.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: user.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: user.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: user.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: user.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3411011151.00007FFD93D57000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: user.exe, 00000002.00000002.3411559326.00007FFD941AA000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\_win32sysloader.pdb source: user.exe, 00000000.00000003.2148730570.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, _win32sysloader.pyd.0.dr
Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: user.exe, 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: user.exe, 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413952189.00007FFDA4634000.00000002.00000001.01000000.00000015.sdmp, _wmi.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source: Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: _rust.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb}},GCTL source: user.exe, 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmp, pythoncom313.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32trace.pdb source: user.exe, 00000000.00000003.2149332664.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\user\tb_digest.cuser_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: _rust.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414197760.00007FFDA5474000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: user.exe, 00000002.00000002.3411559326.00007FFD94112000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414197760.00007FFDA5474000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb!! source: user.exe, 00000002.00000002.3412855086.00007FFD9F3D3000.00000002.00000001.01000000.00000019.sdmp, win32api.pyd.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: user.exe, 00000002.00000002.3411559326.00007FFD941AA000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb source: user.exe, 00000002.00000002.3412855086.00007FFD9F3D3000.00000002.00000001.01000000.00000019.sdmp, win32api.pyd.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: _rust.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413689442.00007FFDA3FD5000.00000002.00000001.01000000.00000016.sdmp, VCRUNTIME140_1.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414439896.00007FFDA54B3000.00000002.00000001.01000000.0000000C.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: user.exe, 00000002.00000002.3413597400.00007FFDA36E3000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: user.exe, 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414328389.00007FFDA5496000.00000002.00000001.01000000.00000010.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413478524.00007FFDA36BB000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414106726.00007FFDA4DA3000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb source: user.exe, 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmp, pythoncom313.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413478524.00007FFDA36BB000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413866301.00007FFDA433D000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413952189.00007FFDA4634000.00000002.00000001.01000000.00000015.sdmp, _wmi.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413777754.00007FFDA4169000.00000002.00000001.01000000.0000000B.sdmp, _socket.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408463161.000001F8471B0000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: user.exe, 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413689442.00007FFDA3FD5000.00000002.00000001.01000000.00000016.sdmp, VCRUNTIME140_1.dll.0.dr
Source: Binary string: D:\a\1\b\libssl-3.pdb source: user.exe, 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: user.exe, 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmp, _ssl.pyd.0.dr
Source: user.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: user.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: user.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: user.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: user.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: VCRUNTIME140.dll.0.dr Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C07B40 PyArg_ParseTuple,?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z,?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,LoadLibraryW,GetProcAddress,PyExc_NotImplementedError,PyErr_Format,PyEval_SaveThread,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread, 2_2_00007FFD93C07B40
PE file contains sections with non-standard names
Source: mfc140u.dll.0.dr Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr Static PE information: section name: .00cfg
Source: python313.dll.0.dr Static PE information: section name: PyRuntim
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35C4331 push rcx; ret 2_2_00007FFDA35C4332

Persistence and Installation Behavior
barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\user.exe Process created: "C:\Users\user\Desktop\user.exe"
Drops PE files
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\win32ui.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\libffi-8.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\libssl-3.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\python313.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pywintypes313.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_wmi.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_cffi_backend.cp313-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md.cp313-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pythoncom313.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\libcrypto-3.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe File created: C:\Users\user\AppData\Local\Temp\_MEI24482\unicodedata.pyd Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157576C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError, 0_2_00007FF7157576C0
Source: C:\Users\user\Desktop\user.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains functionality to detect virtual machines (SGDT)
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35E8816 sgdt fword ptr [rax] 2_2_00007FFDA35E8816
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\win32ui.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\python313.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pywintypes313.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_wmi.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_cffi_backend.cp313-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md.cp313-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pythoncom313.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\user.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\user.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\user.exe API coverage: 1.2 %
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\user.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715759280 FindFirstFileExW,FindClose, 0_2_00007FF715759280
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715771874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF7157583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF7157583C0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715759280 FindFirstFileExW,FindClose, 2_2_00007FF715759280
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF715771874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF7157583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 2_2_00007FF7157583C0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C3540 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc, 2_2_00007FFD9F3C3540
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C53D0 PyArg_ParseTuple,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z, 2_2_00007FFD9F3C53D0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C6440 PyArg_ParseTuple,GetSystemInfo,PyLong_FromUnsignedLongLong,?PyWinLong_FromVoidPtr@@YAPEAU_object@@PEBX@Z,?PyWinLong_FromVoidPtr@@YAPEAU_object@@PEBX@Z,Py_BuildValue, 2_2_00007FFD9F3C6440
Source: user.exe, 00000000.00000003.2134380190.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: user.exe, 00000002.00000003.2158515942.000001F84770C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: ro.kernel.qemu
Source: user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: dro.kernel.qemu
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F84770C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cacert.pem.0.dr Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71576A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF71576A614
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C07B40 PyArg_ParseTuple,?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z,?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,LoadLibraryW,GetProcAddress,PyExc_NotImplementedError,PyErr_Format,PyEval_SaveThread,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread, 2_2_00007FFD93C07B40
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715773480 GetProcessHeap, 0_2_00007FF715773480
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71576A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF71576A614
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71575C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF71575C8A0
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71575D30C SetUnhandledExceptionFilter, 0_2_00007FF71575D30C
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71575D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF71575D12C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71576A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF71576A614
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71575C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FF71575C8A0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71575D30C SetUnhandledExceptionFilter, 2_2_00007FF71575D30C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FF71575D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FF71575D12C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C4B3F4 SetUnhandledExceptionFilter, 2_2_00007FFD93C4B3F4
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C4B20C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FFD93C4B20C
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C4A874 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FFD93C4A874
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93CB3248 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FFD93CB3248
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93CB2C90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FFD93CB2C90
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3D1A98 SetUnhandledExceptionFilter, 2_2_00007FFD9F3D1A98
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3D0CAC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FFD9F3D0CAC
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3D18B0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FFD9F3D18B0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA354FBFC SetUnhandledExceptionFilter, 2_2_00007FFDA354FBFC
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA354FA14 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FFDA354FA14
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA354E8FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FFDA354E8FC
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35849A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FFDA35849A8
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35843F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00007FFDA35843F0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA35A212B IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FFDA35A212B
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA367339C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00007FFDA367339C
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3CDC70 PyArg_ParseTuple,PyEval_SaveThread,keybd_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct, 2_2_00007FFD9F3CDC70
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3CDD10 PyArg_ParseTuple,PyEval_SaveThread,mouse_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct, 2_2_00007FFD9F3CDD10
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\user.exe Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe" Jump to behavior
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3547EB0 PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,GetSecurityDescriptorDacl,free,SetSecurityDescriptorDacl,GetSecurityDescriptorOwner,free,GetSecurityDescriptorGroup,free,free,free, 2_2_00007FFDA3547EB0
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFDA3548D60 PyArg_ParseTuple,PyErr_Clear,PyArg_ParseTuple,PyErr_Clear,PyArg_ParseTuple,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,PyArg_ParseTuple,_Py_Dealloc,AllocateAndInitializeSid,PyExc_ValueError,PyErr_SetString,_Py_NewReference,malloc,memset,memcpy, 2_2_00007FFDA3548D60
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715779570 cpuid 0_2_00007FF715779570
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\license_files VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_ctypes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_bz2.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_lzma.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_socket.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\select.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_ssl.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_hashlib.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_queue.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\unicodedata.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32api.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\gen_py\3.13\__init__.py VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\AppData\Local\Temp\gen_py\3.13\dicts.dat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\errors.log VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF71575D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF71575D010
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C4200 PyArg_ParseTuple,GetUserNameW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z, 2_2_00007FFD9F3C4200
Source: C:\Users\user\Desktop\user.exe Code function: 0_2_00007FF715775C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 0_2_00007FF715775C00
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD9F3C7850 PyArg_ParseTuple,GetVersion,Py_BuildValue, 2_2_00007FFD9F3C7850
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C03430 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,CreateBindCtx,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,PyEval_SaveThread,MkParseDisplayName,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_Dealloc,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,Py_BuildValue, 2_2_00007FFD93C03430
Source: C:\Users\user\Desktop\user.exe Code function: 2_2_00007FFD93C04620 PyArg_ParseTuple,PyEval_SaveThread,CreateBindCtx,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread, 2_2_00007FFD93C04620
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579342 Sample: user.exe Startdate: 21/12/2024 Architecture: WINDOWS Score: 60 22 api.telegram.org 2->22 26 Multi AV Scanner detection for submitted file 2->26 28 AI detected suspicious sample 2->28 7 user.exe 50 2->7         started        signatures3 30 Uses the Telegram API (likely for C&C communication) 22->30 process4 file5 14 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 7->14 dropped 16 C:\Users\user\AppData\Local\...\win32api.pyd, PE32+ 7->16 dropped 18 C:\Users\user\AppData\...\_win32sysloader.pyd, PE32+ 7->18 dropped 20 26 other files (none is malicious) 7->20 dropped 32 Found pyInstaller with non standard icon 7->32 11 user.exe 5 7->11         started        signatures6 process7 dnsIp8 24 api.telegram.org 149.154.167.220, 443, 49709 TELEGRAMRU United Kingdom 11->24
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false

Contacted Domains

Name IP Active
api.telegram.org 149.154.167.220 true