Technical Information
Modifies file system
Creates the following files
- %TEMP%\onefile_3940_134165355152367854\main.dll
- %TEMP%\onefile_3940_134165355152367854\_asyncio.pyd
- %TEMP%\onefile_3940_134165355152367854\_bz2.pyd
- %TEMP%\onefile_3940_134165355152367854\_cffi_backend.pyd
- %TEMP%\onefile_3940_134165355152367854\_ctypes.pyd
- %TEMP%\onefile_3940_134165355152367854\_decimal.pyd
- %TEMP%\onefile_3940_134165355152367854\_hashlib.pyd
- %TEMP%\onefile_3940_134165355152367854\_lzma.pyd
- %TEMP%\onefile_3940_134165355152367854\_multiprocessing.pyd
- %TEMP%\onefile_3940_134165355152367854\_overlapped.pyd
- %TEMP%\onefile_3940_134165355152367854\_queue.pyd
- %TEMP%\onefile_3940_134165355152367854\_socket.pyd
- %TEMP%\onefile_3940_134165355152367854\_ssl.pyd
- %TEMP%\onefile_3940_134165355152367854\_tkinter.pyd
- %TEMP%\onefile_3940_134165355152367854\_uuid.pyd
- %TEMP%\onefile_3940_134165355152367854\libcrypto-1_1.dll
- %TEMP%\onefile_3940_134165355152367854\libffi-7.dll
- %TEMP%\onefile_3940_134165355152367854\libssl-1_1.dll
- %TEMP%\onefile_3940_134165355152367854\msvcp140.dll
- %TEMP%\onefile_3940_134165355152367854\msvcp140_1.dll
- %TEMP%\onefile_3940_134165355152367854\pyexpat.pyd
- %TEMP%\onefile_3940_134165355152367854\python3.dll
- %TEMP%\onefile_3940_134165355152367854\python310.dll
- %TEMP%\onefile_3940_134165355152367854\pythoncom310.dll
- %TEMP%\onefile_3940_134165355152367854\pywintypes310.dll
- %TEMP%\onefile_3940_134165355152367854\qt5core.dll
- %TEMP%\onefile_3940_134165355152367854\qt5gui.dll
- %TEMP%\onefile_3940_134165355152367854\qt5widgets.dll
- %TEMP%\onefile_3940_134165355152367854\select.pyd
- %TEMP%\onefile_3940_134165355152367854\tcl86t.dll
- %TEMP%\onefile_3940_134165355152367854\tk86t.dll
- %TEMP%\onefile_3940_134165355152367854\unicodedata.pyd
- %TEMP%\onefile_3940_134165355152367854\vcruntime140.dll
- %TEMP%\onefile_3940_134165355152367854\vcruntime140_1.dll
- %TEMP%\onefile_3940_134165355152367854\win32api.pyd
- %TEMP%\onefile_3940_134165355152367854\win32evtlog.pyd
- %TEMP%\onefile_3940_134165355152367854\win32gui.pyd
- %TEMP%\onefile_3940_134165355152367854\winsound.pyd
- %TEMP%\onefile_3940_134165355152367854\pil\_imaging.pyd
- %TEMP%\onefile_3940_134165355152367854\pil\_imagingcms.pyd
- %TEMP%\onefile_3940_134165355152367854\pil\_imagingft.pyd
- %TEMP%\onefile_3940_134165355152367854\pil\_imagingmath.pyd
- %TEMP%\onefile_3940_134165355152367854\pil\_imagingtk.pyd
- %TEMP%\onefile_3940_134165355152367854\pil\_webp.pyd
- %TEMP%\onefile_3940_134165355152367854\pyqt5\qtcore.pyd
- %TEMP%\onefile_3940_134165355152367854\pyqt5\qtgui.pyd
- %TEMP%\onefile_3940_134165355152367854\pyqt5\qtwidgets.pyd
- %TEMP%\onefile_3940_134165355152367854\pyqt5\sip.pyd
- %TEMP%\onefile_3940_134165355152367854\certifi\cacert.pem
- %TEMP%\onefile_3940_134165355152367854\charset_normalizer\md.pyd
- %TEMP%\onefile_3940_134165355152367854\charset_normalizer\md__mypyc.pyd
- %TEMP%\onefile_3940_134165355152367854\clr_loader\ffi\dlls\amd64\clrloader.dll
- %TEMP%\onefile_3940_134165355152367854\cv2\cv2.pyd
- %TEMP%\onefile_3940_134165355152367854\cv2\opencv_videoio_ffmpeg4120_64.dll
- %TEMP%\onefile_3940_134165355152367854\markupsafe\_speedups.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\_core\_multiarray_tests.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\_core\_multiarray_umath.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\fft\_pocketfft_umath.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\linalg\_umath_linalg.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\random\_bounded_integers.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\random\_common.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\random\_generator.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\random\_mt19937.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\random\_pcg64.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\random\_philox.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\random\_sfc64.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\random\bit_generator.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy\random\mtrand.pyd
- %TEMP%\onefile_3940_134165355152367854\numpy.libs\libscipy_openblas64_-13e2df515630b4a41f92893938845698.dll
- %TEMP%\onefile_3940_134165355152367854\numpy.libs\msvcp140-263139962577ecda4cd9469ca360a746.dll
- %TEMP%\onefile_3940_134165355152367854\pythonnet\runtime\python.runtime.dll
- %TEMP%\onefile_3940_134165355152367854\static\favicon.ico
- %TEMP%\onefile_3940_134165355152367854\static\icon.png
- %TEMP%\onefile_3940_134165355152367854\static\style.css
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\fire2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\frukti.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\fruktisalat.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\knife2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\myaso.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\ovoshi.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\startcoocking.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\voda.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\voda2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook\whisk2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\fire2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\frukti.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\fruktisalat.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\knife2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\myaso.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\ovoshi.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\ovoshi2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\startcoocking.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\voda.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\voda2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\cook2\whisk2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\gym\gymfault.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\gym\gymstart.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\gym\gymsuccess.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\gym\gym_done.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\g.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\animatsia.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\arter.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\holodniy.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\jgut_down.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\jgut_up.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\kisliy.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\lechenie.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\lechit.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\lechit2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\lechit3.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\led.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\nalojit.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\nedostatochnost.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\obmoroj.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\ognestrel.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\ojog_kislota.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\ojog_sheloch.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\perelom.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\povyazka.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\rabota.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\rabota2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\rabota3.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\rana.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\rastyazenie.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\sheloch.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\tabletka.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\teplo.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\term_ojog.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\tugaya.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\ushib.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\venoznoe.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\heal\vivih.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\relogin\connect.jpg
- %TEMP%\onefile_3940_134165355152367854\static\assets\relogin\connect2.jpg
- %TEMP%\onefile_3940_134165355152367854\static\assets\relogin\connection.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\relogin\enter.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\relogin\place.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\relogin\rasst.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\relogin\reconnect2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\relogin\reconnect3.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\relogin\reconnect4.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\1.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\10.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\11.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\12.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\13.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\14.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\15.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\16.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\17.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\18.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\19.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\20.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\3.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\4.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\5.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\6.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\7.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\8.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\9.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\checkforshveika.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\shveika\stopshveika.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\spin\casinoicon.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\spin\cols.jpg
- %TEMP%\onefile_3940_134165355152367854\static\assets\spin\kasspin.jpg
- %TEMP%\onefile_3940_134165355152367854\static\assets\spin\spinbutton.jpg
- %TEMP%\onefile_3940_134165355152367854\static\assets\stroyka\image1.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\stroyka\image2.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\stroyka\image3.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\stroyka\image4.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\tokar\i3.png
- %TEMP%\onefile_3940_134165355152367854\static\assets\tokar\stameskatest.png
- %TEMP%\onefile_3940_134165355152367854\static\icons\bot.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\chrome1.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\chrome2.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\chrome3.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\chrome4.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\chrome5.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\chrome6.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\line1.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\line2.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\liquid1.ico
- %TEMP%\onefile_3940_134165355152367854\static\icons\liquid2.ico
- %TEMP%\onefile_3940_134165355152367854\static\js\app.js
- %TEMP%\onefile_3940_134165355152367854\static\js\drag.js
- %TEMP%\onefile_3940_134165355152367854\static\js\hotkey.js
- %TEMP%\onefile_3940_134165355152367854\static\js\particles.min.js
- %TEMP%\onefile_3940_134165355152367854\static\wav\beep.wav
- %TEMP%\onefile_3940_134165355152367854\static\wav\click.wav
- %TEMP%\onefile_3940_134165355152367854\static\wav\hover.wav
- %TEMP%\onefile_3940_134165355152367854\static\wav\select.ogg
- %TEMP%\onefile_3940_134165355152367854\static\wav\settings.wav
- %TEMP%\onefile_3940_134165355152367854\static\wav\taxi.wav
- %TEMP%\onefile_3940_134165355152367854\templates\antiafk.html
- %TEMP%\onefile_3940_134165355152367854\templates\bonuspoint.html
- %TEMP%\onefile_3940_134165355152367854\templates\cooking.html
- %TEMP%\onefile_3940_134165355152367854\templates\cow.html
- %TEMP%\onefile_3940_134165355152367854\templates\demorgan.html
- %TEMP%\onefile_3940_134165355152367854\templates\gym.html
- %TEMP%\onefile_3940_134165355152367854\templates\index.html
- %TEMP%\onefile_3940_134165355152367854\templates\keybinds.html
- %TEMP%\onefile_3940_134165355152367854\templates\layout.html
- %TEMP%\onefile_3940_134165355152367854\templates\port.html
- %TEMP%\onefile_3940_134165355152367854\templates\settings.html
- %TEMP%\onefile_3940_134165355152367854\templates\stroyka.html
- %TEMP%\onefile_3940_134165355152367854\templates\taxi.html
- %TEMP%\onefile_3940_134165355152367854\vgamepad\win\vigem\client\x64\vigemclient.dll
- %TEMP%\onefile_3940_134165355152367854\webview\js\api.js
- %TEMP%\onefile_3940_134165355152367854\webview\js\customize.js
- %TEMP%\onefile_3940_134165355152367854\webview\js\finish.js
- %TEMP%\onefile_3940_134165355152367854\webview\js\state.js
- %TEMP%\onefile_3940_134165355152367854\webview\js\lib\dom_json.js
- %TEMP%\onefile_3940_134165355152367854\webview\js\lib\polyfill.js
- %TEMP%\onefile_3940_134165355152367854\webview\lib\microsoft.web.webview2.core.dll
- %TEMP%\onefile_3940_134165355152367854\webview\lib\microsoft.web.webview2.winforms.dll
- %TEMP%\onefile_3940_134165355152367854\webview\lib\webbrowserinterop.x64.dll
- %TEMP%\onefile_3940_134165355152367854\webview\lib\pywebview-android.jar
- %TEMP%\onefile_3940_134165355152367854\webview\lib\runtimes\win-x64\native\webview2loader.dll
Network activity
Connects to
- 'localhost':5000
- 'gi##lic.ru':443
- 'pu##s.ru':443
- 'fo###.#oogleapis.com':443
- 'fo###.gstatic.com':443
TCP
HTTP GET requests
- http://12#.#.0.1:5000/static/js/particles.min.js
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?39##############
Other
- 'gi##lic.ru':443
- 'pu##s.ru':443
- 'localhost':49700
- 'localhost':49703
- 'localhost':49705
- 'localhost':49706
- 'localhost':49704
- 'fo###.#oogleapis.com':443
- 'fo###.gstatic.com':443
UDP
- DNS ASK gi##lic.ru
- DNS ASK pu##s.ru
- DNS ASK fo###.#oogleapis.com
- DNS ASK fo###.gstatic.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
