26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware_60.0 Sample 3d307fa80e30… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3d307fa80e30…. Malware family: Malware_60.0. Threat score 100/100. 2/25 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","keywords":["Malicious","Malware_60.0","malware analysis","sandbox report","threat intelligence","3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d"],"about":{"@type":"SoftwareApplication","name":"Instaloader-GUI-Wrapper_v.1.4.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware_60.0","antivirusDetections":{"malicious":2,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2a77,Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PeekNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "K32EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")28:T1e4d,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "The predefined compression dictionary. This is a sequence of bytes" (Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000003.182558.61A7C000.00000004.mdmp, 00000000-00001580.00000003.182558.63919000.00000004.mdmp") Found string "The functions in this module allow compression and decompression using the" (Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp") Found string "compress(data[, level]) -- Compress data, with compression level 0-9 or -1." (Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp") Found string "the appropriate compression extension (".gz", ".bz2", or ".xz")." (Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "For one-shot decompression, use the decompress() function instead." (Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000000.172102.63B50000.00000004.mdmp, 00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63B50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.CE0B7000.00000002.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.639BD000.00000004.mdmp, 00000000-00001580.00000003.182558.63B50000.00000004.mdmp, 00000000-00001580.00000003.182558.CE0DE000.00000002.mdmp") Found string "Interface to the liblzma compression library." (Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "classes for incremental (de)compression, and convenience functions for" (Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "one-shot (de)compression." (Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "_compression" (Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000000.172102.63B50000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000002.175944.63B50000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63B50000.00000004.mdmp") Found string "bad value for 'compress', or compression format not supported : {0}" (Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "Interface to the libbzip2 compression library." (Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "(de)compression, and functions for one-shot (de)compression." (Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "Cannot specify a preset compression level when opening a file for reading" (Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "tar_compression" (Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "compression" (Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000000.172102.BA977000.00000002.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.BA977000.00000002.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.CE01D000.00000002.mdmp") Found string "ZipFile" (Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "A file object providing transparent bzip2 (de)compression." (Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "A file object providing transparent LZMA (de)compression." (Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "decompression to fail if the input cannot be decompressed within the" (Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.CE0B7000.00000002.mdmp, 00000000-00001580.00000003.182558.639BD000.00000004.mdmp") Found string "For incremental compression, use an LZMACompressor instead." (Source: "00000000-00001580.00000000.172102.63B50000.00000004.mdmp, 00000000-00001580.00000002.175944.63B50000.00000004.mdmp, 00000000-00001580.00000003.182558.63B50000.00000004.mdmp") Found string "For incremental decompression, use an LZMADecompressor instead." (Source: "00000000-00001580.00000000.172102.63B50000.00000004.mdmp, 00000000-00001580.00000002.175944.63B50000.00000004.mdmp, 00000000-00001580.00000003.182558.63B50000.00000004.mdmp") Found string "C:\Users\FYapzQ3\AppData\Local\Temp\_MEI43762\_compression.py" (Source: "00000000-00001580.00000000.172102.63B50000.00000004.mdmp, 00000000-00001580.00000002.175944.63B50000.00000004.mdmp, 00000000-00001580.00000003.182558.63B50000.00000004.mdmp") Found string "For incremental decompression, use a BZ2Decompressor object instead." (Source: "00000000-00001580.00000000.172102.63B50000.00000004.mdmp, 00000000-00001580.00000002.175944.63B50000.00000004.mdmp, 00000000-00001580.00000003.182558.63B50000.00000004.mdmp")29:Ta96,file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") Found reference to "_hashlib.HMAC" (Indicator: "HMAC"; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.CE067000.00000002.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.BC630000.00000002.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000000.172102.64DC0000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.BC01D000.00000002.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.64DC0000.00000004.mdmp, 00000000-00001580.00000003.182558.64DC0000.00000004.mdmp, 00000000-00001580.00000003.182558.BC630000.00000002.mdmp, 00000000-00001580.00000003.182558.CE067000.00000002.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000000.172102.64DC0000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.64DC0000.00000004.mdmp, 00000000-00001580.00000003.182558.64DC0000.00000004.mdmp, 00000000-00001580.00000003.182558.BC630000.00000002.mdmp, 00000000-00001580.00000003.182558.CE067000.00000002.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63D4D000.00000004.mdmp, 00000000-00001580.00000003.182558.BC630000.00000002.mdmp, 00000000-00001580.00000003.182558.CE067000.00000002.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63D4D000.00000004.mdmp, 00000000-00001580.00000003.182558.BC630000.00000002.mdmp, 00000000-00001580.00000003.182558.CE067000.00000002.mdmp")2a:Tb1e,"Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00004376-00000C15-1091896212 [PID: 4376] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00004376-00000C15-1091903016 [PID: 4376] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00004376-00000C15-1092194819 [PID: 4376] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00004376-00000C15-1092202166 [PID: 4376] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1105454037 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1105462087 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1105657946 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1105665532 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1105836639 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1105847671 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1107285027 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1107292263 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1107901538 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1107909775 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1108103636 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1108111433 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1111963249 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1111971547 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1112154826 [PID: 1580] "Instaloader-GUI-Wrapper_v.1.4.exe" queried SystemProcessInformation at 00000000-00001580-00000C15-1112162438 [PID: 1580] "cmd.exe" queried SystemProcessInformation at 00000000-00008280-00000C15-1111052473 [PID: 8280] "cmd.exe" queried SystemProcessInformation at 00000000-00008280-00000C15-1111060224 [PID: 8280] "cmd.exe" queried SystemProcessInformation at 00000000-00008280-00000C15-1111227123 [PID: 8280] "cmd.exe" queried SystemProcessInformation at 00000000-00008280-00000C15-1111250444 [PID: 8280]2b:Ta0e,Found string "https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688" (Indicator: "github.com"; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25" (Indicator: "github.com"; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000003.182558.63924000.00000004.mdmp") Found string "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97" (Indicator: "github.com"; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000003.182558.63924000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11" (Indicator: "github.com"; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000003.182558.63924000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422" (Indicator: "github.com"; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000003.182558.63924000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312" (Indicator: "github.com"; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000003.182558.63924000.00000004.mdmp") Found string "argument types, see https://github.com/python/cpython/issues/86361." (Indicator: "github.com"; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp")2c:T16d9,"Instaloader-GUI-Wrapper_v.1.4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000405ac6635a0200001019cee7f97f00000000000000000000000055645a0200000000000000000000ee26a4e5f97f00000700000000000000d0b4fee3d2000000d0b4fee3d2000000400eb2e5f97f0000000055645a0200007b6349e5f97f0000020000000000000000000000000000009200000000000000a004c5645a020000c0b4fee3d2000000bb5fa4e5f97f00000d0000005a020000a004c5645a02000092000000000000000000000000000000a004c5645a0200001c5ba4e5f97f0000000000000000000092000000000000000d0000005a0200000d00000000000000aa00000000000000d24566645a020000a03a6b64 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000350000005a020000793a9c615a02000001000000000000000200000000000000f4b94fbdf97f0000200b2c635a020000e80b2c635a020000b04f78635a020000103a78635a020000103a78635a020000c0a0fee3d2000000010000000000000065bd4fbdf97f0000013a78635a020000f5262a43eef5587ee0b098bdf97f000001000000f97f0000404b78635a020000a0ddaabdf97f0000402979635a0200005e1448bdf97f0000402979635a02000015411d0ef11fe9d5200b2c635a020000a0a1fee3d2000000103a78635a020000e80b2c635a020000b04f78635a020000e0b098bdf97f0000b0a1fee3d2000000e7b94fbdf97f0000103a7863 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000000000000000000000000ffffffffffffffff40aafee3d200000000000000000000001019cee7f97f000040aafee3d2000000e47a47e5f97f000000000000000000008000000000000000b1311c0542ac0000567f4be5f97f0000ffffffffffffffff020000000000000000000000000000001f000f0000000000000000000000000030aafee3d200000040aafee3d20000000100000000000000000000000000000004000000000000000000000000000000000092655a0200000010000000000000000000000000000001000000000000002e7e4be5f97f0000500000000000000030aafee3d20000008200000000000000000000000000000008000000 (UID: 00000000-00001580) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008280)2d:T1049,"Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" at 00000000-00004376-00000C17-1092511572 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6" at 00000000-00004376-00000C17-1092516020 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin" at 00000000-00004376-00000C17-1092516790 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" at 00000000-00004376-00000C17-1092523946 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6" at 00000000-00004376-00000C17-1092524661 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin" at 00000000-00004376-00000C17-1092525362 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" at 00000000-00004376-00000C17-1092559102 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6" at 00000000-00004376-00000C17-1092559880 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin" at 00000000-00004376-00000C17-1092560543 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" at 00000000-00004376-00000C17-1093806071 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6" at 00000000-00004376-00000C17-1093806997 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin" at 00000000-00004376-00000C17-1093807665 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" at 00000000-00004376-00000C17-1094733336 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6" at 00000000-00004376-00000C17-1094733980 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin" at 00000000-00004376-00000C17-1094734653 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" at 00000000-00004376-00000C17-1094909127 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6" at 00000000-00004376-00000C17-1094909826 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin" at 00000000-00004376-00000C17-1094910508 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" at 00000000-00004376-00000C17-1095591065 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6" at 00000000-00004376-00000C17-1095591763 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin" at 00000000-00004376-00000C17-1095592413 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" at 00000000-00004376-00000C17-1095657951 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6" at 00000000-00004376-00000C17-1095658606 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin" at 00000000-00004376-00000C17-1095659235 "Instaloader-GUI-Wrapper_v.1.4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" at 00000000-00004376-00000C17-10963176522e:Tbf2,"Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6\Qt6 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6\Qt6\bin (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\generic (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\iconengines (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\styles (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\PyQt6\Qt6\translations (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\certifi (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\charset_normalizer (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\setuptools (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\setuptools\_vendor (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\setuptools\_vendor\jaraco (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI43762\setuptools\_vendor\jaraco\text (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\.cache\qdarktheme\v2.1.0 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\.cache\qdarktheme (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\.cache (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "CreateDirectoryW" with parameter C:\user-settings (UID: 00000000-00001580)2f:T16fe,"Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter VCRUNTIME140_1.dll (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\python313.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\python3 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\_ctypes.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\_bz2.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\_lzma.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\QtCore.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\sip.cp313-win_amd64.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\_queue.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\_wmi.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\_hashlib.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\_socket.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\select.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\_ssl.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\QtWidgets.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\QtGui.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\QtSvg.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\charset_normalizer\md.cp313-win_amd64.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\charset_normalizer\md__mypyc.cp313-win_amd64.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\unicodedata.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\_uuid.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qwindows.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qico.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\iconengines\qsvgicon.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qsvg.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter d3d10warp.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001580)30:T4a06,"Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004376) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter VirtualAlloc2FromApp (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemoryEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumberEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetNumaProcessorNodeEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetNumaNodeProcessorMaskEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetNumaProcessorNode (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter Py_PreInitialize (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInitConfig_Create (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyConfig_Clear (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyConfig_InitIsolatedConfig (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyConfig_Read (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyConfig_SetBytesString (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyConfig_SetString (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyConfig_SetWideStringList (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter Py_InitializeFromConfig (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter Py_ExitStatusException (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyPreConfig_InitIsolatedConfig (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyStatus_Exception (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit_QtCore (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit_sip (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit__queue (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit__wmi (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit__hashlib (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit__ssl (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit_QtWidgets (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit_QtGui (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit_QtSvg (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit_md (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit_md__mypyc (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit_unicodedata (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter PyInit__uuid (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter qt_plugin_instance (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RtlSubscribeWnfStateChangeNotification (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter OpenAdapter (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter D3DKMTEnumAdapters2 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "GetProcAddress" with a parameter NtUpdateWnfStateData (UID: 00000000-00001580) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008280) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008280) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008280) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008280) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008280) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008280)31:Tb30,"Qt6Network.dll" contains export function called "??0DtlsBase@QTlsPrivate@@QEAA@AEBV01@@Z" at ordinal 1 "Qt6Network.dll" contains export function called "??0DtlsBase@QTlsPrivate@@QEAA@XZ" at ordinal 2 "Qt6Network.dll" contains export function called "??0DtlsCookieVerifier@QTlsPrivate@@QEAA@$$QEAV01@@Z" at ordinal 3 "Qt6Network.dll" contains export function called "??0DtlsCookieVerifier@QTlsPrivate@@QEAA@AEBV01@@Z" at ordinal 4 "Qt6Network.dll" contains export function called "??0DtlsCookieVerifier@QTlsPrivate@@QEAA@XZ" at ordinal 5 "Qt6Network.dll" contains export function called "??0DtlsCryptograph@QTlsPrivate@@QEAA@$$QEAV01@@Z" at ordinal 6 "Qt6Network.dll" contains export function called "??0DtlsCryptograph@QTlsPrivate@@QEAA@AEBV01@@Z" at ordinal 7 "Qt6Network.dll" contains export function called "??0DtlsCryptograph@QTlsPrivate@@QEAA@XZ" at ordinal 8 "Qt6Network.dll" contains export function called "??0GeneratorParameters@QDtlsClientVerifier@@QEAA@$$QEAU01@@Z" at ordinal 9 "Qt6Network.dll" contains export function called "??0GeneratorParameters@QDtlsClientVerifier@@QEAA@AEBU01@@Z" at ordinal 10 "Qt6Network.dll" contains export function called "??0GeneratorParameters@QDtlsClientVerifier@@QEAA@W4Algorithm@QCryptographicHash@@AEBVQByteArray@@@Z" at ordinal 11 "Qt6Network.dll" contains export function called "??0GeneratorParameters@QDtlsClientVerifier@@QEAA@XZ" at ordinal 12 "Qt6Network.dll" contains export function called "??0QAbstractNetworkCache@@IEAA@AEAVQAbstractNetworkCachePrivate@@PEAVQObject@@@Z" at ordinal 13 "Qt6Network.dll" contains export function called "??0QAbstractNetworkCache@@IEAA@PEAVQObject@@@Z" at ordinal 14 "Qt6Network.dll" contains export function called "??0QAbstractSocket@@IEAA@W4SocketType@0@AEAVQAbstractSocketPrivate@@PEAVQObject@@@Z" at ordinal 15 "Qt6Network.dll" contains export function called "??0QAbstractSocket@@QEAA@W4SocketType@0@PEAVQObject@@@Z" at ordinal 16 "Qt6Network.dll" contains export function called "??0QAbstractSocketPrivate@@QEAA@W4QtPrivate_6_10_1@@@Z" at ordinal 17 "Qt6Network.dll" contains export function called "??0QAuthenticator@@QEAA@AEBV0@@Z" at ordinal 18 "Qt6Network.dll" contains export function called "??0QAuthenticator@@QEAA@XZ" at ordinal 19 "Qt6Network.dll" contains export function called "??0QAuthenticatorPrivate@@QEAA@XZ" at ordinal 20 "Qt6Network.dll" contains export function called "??0QDnsDomainNameRecord@@QEAA@AEBV0@@Z" at ordinal 21 "Qt6Network.dll" contains export function called "??0QDnsDomainNameRecord@@QEAA@XZ" at ordinal 22 "Qt6Network.dll" contains export function called "??0QDnsHostAddressRecord@@QEAA@AEBV0@@Z" at ordinal 23 "Qt6Network.dll" contains export function called "??0QDnsHostAddressRecord@@QEAA@XZ" at ordinal 24 "Qt6Network.dll" contains export function called "??0QDnsLookup@@QEAA@PEAVQObject@@@Z" at ordinal 2532:T7a7,Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4376:304:WilStaging_02" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4376:304:WilStaging_02" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "Local\SM0:4376:304:WilStaging_02" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "SM0:4376:304:WilStaging_02" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1580:304:WilStaging_02" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1580:304:WilStaging_02" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\__DDrawExclMode__" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\__DDrawCheckExclMode__" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "SM0:1580:304:WilStaging_02" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "Local\SM0:1580:304:WilStaging_02" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "SM0:1580:120:WilError_03" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "Local\SessionImmersiveColorMutex" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "__DDrawCheckExclMode__" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "__DDrawExclMode__" Process Instaloader-GUI-Wrapper_v.1.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1580:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8280:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:8280:304:WilStaging_02"33:T99d,Antivirus vendors marked dropped file "opengl32sw.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "Qt6Core.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "Qt6Pdf.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "Qt6Widgets.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "Qt6Gui.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "qwindows.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "Qt6Svg.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "qjpeg.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "qwebp.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "MSVCP140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "qtiff.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "MSVCP140_2.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "qmodernwindowsstyle.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "VCRUNTIME140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "qoffscreen.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "qtuiotouchplugin.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "qsvgicon.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "qminimal.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections")34:Tf4b,"Instaloader-GUI-Wrapper_v.1.4.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Qt6Network.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qwindows.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "Qt6Svg.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qjpeg.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qwebp.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MSVCP140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qtiff.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MSVCP140_2.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qmodernwindowsstyle.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qoffscreen.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qtuiotouchplugin.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qsvgicon.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qminimal.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qicns.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "VCRUNTIME140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qgif.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qico.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qpdf.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "qsvg.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF35:Td84,"Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00001580.00000000.172102.636F0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00001580.00000000.172102.636F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001580.00000000.172102.64CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001580.00000000.172102.64DC0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00001580.00000001.174023.636F0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00001580.00000001.174023.636F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001580.00000001.174023.65620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001580.00000002.175944.64CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001580.00000002.175944.64DC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001580.00000002.175944.651C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001580.00000002.175944.651C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00001580.00000002.175944.BB76F000.00000002.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00001580.00000002.175944.BB76F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Avalon.Graphics\DISPLAY1" in Source: 00000000-00001580.00000002.175944.BF9AD000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00001580.00000002.175944.BF9AD000.00000002.mdmp "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mailto\UserChoice" in Source: 00000000-00001580.00000002.175944.BF9AD000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001580.00000002.175944.BF9AD000.00000002.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00001580.00000003.182558.636F0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00001580.00000003.182558.636F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001580.00000003.182558.64CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001580.00000003.182558.64DC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001580.00000003.182558.651C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001580.00000003.182558.651C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001580.00000003.182558.65620000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9FC8E510-A" in Source: 00000000-00001580.00000003.182558.6638F000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9|" in Source: 00000000-00001580.00000003.182558.6638F000.00000004.mdmp36:T1ab8,"Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9d3fa0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9e5450000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9e5450000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff9e5450000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9e5450000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "RPCRT4.DLL" at base 7ff9e7180000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "VCRUNTIME140.DLL" at base 7ff9daca0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "VCRUNTIME140_1.DLL" at base 7ff9d9840000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "NTDLL.DLL" at base 7ff9e7c90000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9e2cc0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "KERNELBASE.DLL" at base 7ff9e5450000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "KERNEL32.DLL" at base 7ff9e6970000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYTHON313.DLL" at base 7ff9bd460000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9e5320000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ff9e5450000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYTHON3" at base 25a632d0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\_CTYPES.PYD" at base 7ff9d3f70000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "KERNEL32" at base 7ff9e6970000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\_BZ2.PYD" at base 7ff9ce0d0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\_LZMA.PYD" at base 7ff9ce0a0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\QTCORE.PYD" at base 7ff9bd1d0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\SIP.CP313-WIN_AMD64.PYD" at base 7ff9ce080000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\_QUEUE.PYD" at base 7ff9d3f60000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\_WMI.PYD" at base 7ff9d00b0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\_HASHLIB.PYD" at base 7ff9ce060000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\_SOCKET.PYD" at base 7ff9ce040000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\SELECT.PYD" at base 7ff9d0080000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\_SSL.PYD" at base 7ff9ce010000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "GDI32.DLL" at base 7ff9e5ec0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\QTWIDGETS.PYD" at base 7ff9bba00000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\QTGUI.PYD" at base 7ff9ba840000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "OLE32.DLL" at base 7ff9e60d0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff9e5450000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff9d7610000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff9d7650000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff9e5450000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff9e5450000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff9d70a0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "AMSI.DLL" at base 7ff9d6aa0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\627ES8T4.DLL" at base 7ff9e27f0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "ADVAPI32" at base 7ff9e5fa0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\QTSVG.PYD" at base 7ff9cdf70000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff9e49d0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\CHARSET_NORMALIZER\MD.CP313-WIN_AMD64.PYD" at base 7ff9cf4b0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\CHARSET_NORMALIZER\MD__MYPYC.CP313-WIN_AMD64.PYD" at base 7ff9cdf40000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\UNICODEDATA.PYD" at base 7ff9c0d10000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\_UUID.PYD" at base 7ff9cf180000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\QT6\PLUGINS\PLATFORMS\QWINDOWS.DLL" at base 7ff9bf910000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "COMBASE.DLL" at base 7ff9e74d0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ff9d5e00000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.IMMERSIVE.DLL" at base 7ff9d3cf0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\QT6\PLUGINS\STYLES\QMODERNWINDOWSSTYLE.DLL" at base 7ff9c5670000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\QT6\PLUGINS\IMAGEFORMATS\QICO.DLL" at base 7ff9ce2c0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\QT6\PLUGINS\ICONENGINES\QSVGICON.DLL" at base 7ff9cdf20000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%TEMP%\_MEI43762\PYQT6\QT6\PLUGINS\IMAGEFORMATS\QSVG.DLL" at base 7ff9cdeb0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "D3D10WARP.DLL" at base 7ff9dc740000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ff9cb270000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff9e7320000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff9e7320000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff9e74d0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff9e60d0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff9e5cb0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7ff9e2fd0000 "Instaloader-GUI-Wrapper_v.1.4.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff9e31b0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9d3fa000037:Tc80,"Instaloader-GUI-Wrapper_v.1.4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Instaloader-GUI-Wrapper_v.1.4.exe" was detected as "Microsoft Linker" and name: "Linker" "Qt6Network.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Qt6Network.dll" was detected as "Microsoft Linker" and name: "Linker" "qwindows.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qwindows.dll" was detected as "Microsoft Linker" and name: "Linker" "Qt6Svg.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Qt6Svg.dll" was detected as "Microsoft Linker" and name: "Linker" "qjpeg.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qjpeg.dll" was detected as "Microsoft Linker" and name: "Linker" "qwebp.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qwebp.dll" was detected as "Microsoft Linker" and name: "Linker" "MSVCP140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MSVCP140.dll" was detected as "Microsoft Linker" and name: "Linker" "qtiff.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qtiff.dll" was detected as "Microsoft Linker" and name: "Linker" "MSVCP140_2.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MSVCP140_2.dll" was detected as "Microsoft Linker" and name: "Linker" "qmodernwindowsstyle.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qmodernwindowsstyle.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Linker" and name: "Linker" "qoffscreen.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qoffscreen.dll" was detected as "Microsoft Linker" and name: "Linker" "qtuiotouchplugin.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qtuiotouchplugin.dll" was detected as "Microsoft Linker" and name: "Linker" "qsvgicon.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qsvgicon.dll" was detected as "Microsoft Linker" and name: "Linker" "qminimal.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qminimal.dll" was detected as "Microsoft Linker" and name: "Linker" "qicns.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qicns.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "qgif.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qgif.dll" was detected as "Microsoft Linker" and name: "Linker" "qico.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qico.dll" was detected as "Microsoft Linker" and name: "Linker" "qpdf.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qpdf.dll" was detected as "Microsoft Linker" and name: "Linker" "qsvg.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qsvg.dll" was detected as "Microsoft Linker" and name: "Linker"38:T5eb,"Instaloader-GUI-Wrapper_v.1.4.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "Qt6Network.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qwindows.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "Qt6Svg.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qjpeg.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qwebp.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MSVCP140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qtiff.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MSVCP140_2.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qmodernwindowsstyle.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qoffscreen.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qtuiotouchplugin.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qsvgicon.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qminimal.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qicns.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qgif.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qico.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qpdf.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "qsvg.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"39:T4ec,"Instaloader-GUI-Wrapper_v.1.4.exe" has an executable section named ".text" "Qt6Network.dll" has an executable section named ".text" "qwindows.dll" has an executable section named ".text" "Qt6Svg.dll" has an executable section named ".text" "qjpeg.dll" has an executable section named ".text" "qwebp.dll" has an executable section named ".text" "MSVCP140.dll" has an executable section named ".text" "qtiff.dll" has an executable section named ".text" "MSVCP140_2.dll" has an executable section named ".text" "qmodernwindowsstyle.dll" has an executable section named ".text" "VCRUNTIME140.dll" has an executable section named ".text" "VCRUNTIME140.dll" has an executable section named "fothk" "qoffscreen.dll" has an executable section named ".text" "qtuiotouchplugin.dll" has an executable section named ".text" "qsvgicon.dll" has an executable section named ".text" "qminimal.dll" has an executable section named ".text" "qicns.dll" has an executable section named ".text" "VCRUNTIME140_1.dll" has an executable section named ".text" "qgif.dll" has an executable section named ".text" "qico.dll" has an executable section named ".text" "qpdf.dll" has an executable section named ".text" "qsvg.dll" has an executable section named ".text"3a:T4d4,"Instaloader-GUI-Wrapper_v.1.4.exe" has an writable section named ".data" "Instaloader-GUI-Wrapper_v.1.4.exe" has an writable section named ".fptable" "Qt6Network.dll" has an writable section named ".data" "qwindows.dll" has an writable section named ".data" "Qt6Svg.dll" has an writable section named ".data" "qjpeg.dll" has an writable section named ".data" "qwebp.dll" has an writable section named ".data" "MSVCP140.dll" has an writable section named ".data" "qtiff.dll" has an writable section named ".data" "MSVCP140_2.dll" has an writable section named ".data" "qmodernwindowsstyle.dll" has an writable section named ".data" "VCRUNTIME140.dll" has an writable section named ".data" "qoffscreen.dll" has an writable section named ".data" "qtuiotouchplugin.dll" has an writable section named ".data" "qsvgicon.dll" has an writable section named ".data" "qminimal.dll" has an writable section named ".data" "qicns.dll" has an writable section named ".data" "VCRUNTIME140_1.dll" has an writable section named ".data" "qgif.dll" has an writable section named ".data" "qico.dll" has an writable section named ".data" "qpdf.dll" has an writable section named ".data" "qsvg.dll" has an writable section named ".data"3b:T2d9c,"Instaloader-GUI-Wrapper_v.1.4.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000dc90,add rsp, 0x28,jmp 0x14000d8bc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000e324,test eax, eax,je 0x14000da7e,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000da71,cmp rcx, rax,je 0x14000da85,xor eax, eax,lock cmpxchg qword ptr [rip + 0x378bc], rcx,jne 0x14000da6c,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000da80,int3 ,int3 ,int3 ,sub rsp, 0x28,test ecx, ecx,jne 0x14000da9b," "Qt6Network.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18010d801,call 0x18010dcec,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18010d6a8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rsi,push rdi,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ,mov r8d, ecx,xor r11d, r11d,mov r10d, edx," "qwindows.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180095b31,call 0x180096008,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800959d8,int3 ,int3 ,int3 ,sub rsp, 0x48,lea rcx, [rsp + 0x20],call 0x1800224e0,lea rdx, [rip + 0x37653],lea rcx, [rsp + 0x20],call 0x1800961e2,int3 ," "Qt6Svg.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800633b1,call 0x180063738,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180063258,int3 ,int3 ,int3 ,and qword ptr [rcx + 0x10], 0,lea rax, [rip + 0x8ea4],mov qword ptr [rcx + 8], rax,lea rax, [rip + 0x78a1],mov qword ptr [rcx], rax,mov rax, rcx,ret ,int3 ,int3 ,sub rsp, 0x48," "qjpeg.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800690e1,call 0x1800698d0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180068f88,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xf47],mov rcx, rbx,call qword ptr [rip + 0xf46],call qword ptr [rip + 0xf30],mov rcx, rax," "qwebp.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18006e671,call 0x18006eb18,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18006e518,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x9ccd],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "MSVCP140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18004dad1,call 0x18004e080,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18004d97c,int3 ,int3 ,int3 ,jmp 0x18004e26c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rbp,mov qword ptr [rsp + 0x20], rsi,push rdi,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ," "qtiff.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18003b151,call 0x18003b7a8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18003aff8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x2567d],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "MSVCP140_2.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800301f1,call 0x1800309f0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18003009c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rbp,mov qword ptr [rsp + 0x20], rsi,push rdi,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ,xor ecx, 0x6c65746e," "qmodernwindowsstyle.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180023781,call 0x180023dd8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180023628,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rsi,push rdi,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ,mov r8d, ecx,xor r11d, r11d,mov r10d, edx," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800103b1,call 0x180011a2c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180010320,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ," "qoffscreen.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000c201,call 0x18000c868,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000c0a8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x2d5d],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "qtuiotouchplugin.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000f5d1,call 0x18000fae8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000f478,int3 ,int3 ,int3 ,and qword ptr [rcx + 0x10], 0,lea rax, [rip + 0x1c6c],mov qword ptr [rcx + 8], rax,lea rax, [rip + 0x1701],mov qword ptr [rcx], rax,mov rax, rcx,ret ,int3 ,int3 ,sub rsp, 0x48," "qsvgicon.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180009421,call 0x180009a88,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800092c8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x145d],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "qminimal.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180003201,call 0x1800036e0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800030a8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x265d],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "qicns.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180005a01,call 0x180005ee0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800058a8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x272d],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "VCRUNTIME140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180004131,call 0x1800046b8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004098,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x28,mov qword ptr [rsp + 0x30], rcx,mov qword ptr [rsp + 0x38], rdx,mov dword ptr [rsp + 0x40], r8d," "qgif.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180004c61,call 0x1800052c8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004b08,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x1a9d],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "qico.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180003f41,call 0x1800045a8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180003de8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x18bd],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "qpdf.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800030c1,call 0x180003728,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002f68,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x184d],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0," "qsvg.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002971,call 0x180002fd8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002818,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x1e1d],xorps xmm0, xmm0,mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],lea rcx, [rax + 8],movups xmmword ptr [rdx], xmm0,"3c:T432,"Instaloader-GUI-Wrapper_v.1.4.exe" has high imagebase "0x140000000" "Qt6Network.dll" has high imagebase "0x180000000" "qwindows.dll" has high imagebase "0x180000000" "Qt6Svg.dll" has high imagebase "0x180000000" "qjpeg.dll" has high imagebase "0x180000000" "qwebp.dll" has high imagebase "0x180000000" "MSVCP140.dll" has high imagebase "0x180000000" "qtiff.dll" has high imagebase "0x180000000" "MSVCP140_2.dll" has high imagebase "0x180000000" "qmodernwindowsstyle.dll" has high imagebase "0x180000000" "VCRUNTIME140.dll" has high imagebase "0x180000000" "qoffscreen.dll" has high imagebase "0x180000000" "qtuiotouchplugin.dll" has high imagebase "0x180000000" "qsvgicon.dll" has high imagebase "0x180000000" "qminimal.dll" has high imagebase "0x180000000" "qicns.dll" has high imagebase "0x180000000" "VCRUNTIME140_1.dll" has high imagebase "0x180000000" "qgif.dll" has high imagebase "0x180000000" "qico.dll" has high imagebase "0x180000000" "qpdf.dll" has high imagebase "0x180000000" "qsvg.dll" has high imagebase "0x180000000"3d:Ta2c,"Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA-DK") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA-DK") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL-GR") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL-GR") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES_TRADNL") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES_TRADNL") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FI-FI") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FI-FI") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-FR") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-FR") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "HU-HU") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU") "Instaloader-GUI-Wrapper_v.1.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IT-IT")3e:T767f,"opengl32sw.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\opengl32sw.dll]- [targetUID: 00000000-00004376] "Qt6Core.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Core.dll]- [targetUID: 00000000-00001580] "Qt6Pdf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Pdf.dll]- [targetUID: 00000000-00004376] "Qt6Widgets.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Widgets.dll]- [targetUID: 00000000-00001580] "Qt6Gui.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Gui.dll]- [targetUID: 00000000-00001580] "Qt6Network.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Network.dll]- [targetUID: 00000000-00004376] "qwindows.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qwindows.dll]- [targetUID: 00000000-00001580] "Qt6Svg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Svg.dll]- [targetUID: 00000000-00001580] "qjpeg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qjpeg.dll]- [targetUID: 00000000-00001580] "qwebp.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qwebp.dll]- [targetUID: 00000000-00001580] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140.dll]- [targetUID: 00000000-00001580] "qtiff.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qtiff.dll]- [targetUID: 00000000-00001580] "MSVCP140_2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140_2.dll]- [targetUID: 00000000-00001580] "qmodernwindowsstyle.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140.dll]- [targetUID: 00000000-00001580] "qoffscreen.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qoffscreen.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\VCRUNTIME140.dll]- [targetUID: 00000000-00001580] "qtuiotouchplugin.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\generic\qtuiotouchplugin.dll]- [targetUID: 00000000-00004376] "qsvgicon.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\iconengines\qsvgicon.dll]- [targetUID: 00000000-00001580] "qminimal.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qminimal.dll]- [targetUID: 00000000-00001580] "qicns.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qicns.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001580] "qgif.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qgif.dll]- [targetUID: 00000000-00001580] "qico.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qico.dll]- [targetUID: 00000000-00001580] "qpdf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qpdf.dll]- [targetUID: 00000000-00001580] "qsvg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qsvg.dll]- [targetUID: 00000000-00001580] "qtga.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qtga.dll]- [targetUID: 00000000-00001580] "qwbmp.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qwbmp.dll]- [targetUID: 00000000-00001580] "MSVCP140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140_1.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001580] "drag_indicator_e4e7eb66_90.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\drag_indicator_e4e7eb66_90.svg]- [targetUID: 00000000-00001580] "drag_indicator_e1e5e9_90.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\drag_indicator_e1e5e9_90.svg]- [targetUID: 00000000-00001580] "drag_indicator_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\drag_indicator_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "drag_indicator_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\drag_indicator_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "close_e4e7eb99_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\close_e4e7eb99_0.svg]- [targetUID: 00000000-00001580] "close_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\close_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "check_box_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\check_box_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "calendar_today_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\calendar_today_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "chevron_right_e4e7eb66_180.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\chevron_right_e4e7eb66_180.svg]- [targetUID: 00000000-00001580] "chevron_right_e4e7eb99_180.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\chevron_right_e4e7eb99_180.svg]- [targetUID: 00000000-00001580] "close_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\close_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "check_box_8ab4f7_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\check_box_8ab4f7_0.svg]- [targetUID: 00000000-00001580] "calendar_today_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\calendar_today_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "drag_handle_e4e7eb66_90.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\drag_handle_e4e7eb66_90.svg]- [targetUID: 00000000-00001580] "check_box_outline_blank_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\check_box_outline_blank_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "radio_button_checked_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\radio_button_checked_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "expand_less_e4e7eb66_180.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\expand_less_e4e7eb66_180.svg]- [targetUID: 00000000-00001580] "chevron_right_e1e5e9_180.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\chevron_right_e1e5e9_180.svg]- [targetUID: 00000000-00001580] "chevron_right_e4e7eb99_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\chevron_right_e4e7eb99_0.svg]- [targetUID: 00000000-00001580] "chevron_right_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\chevron_right_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_ffffff5f_270.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_ffffff5f_270.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_ffffff2f_180.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_ffffff2f_180.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_ffffff5f_180.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_ffffff5f_180.svg]- [targetUID: 00000000-00001580] "indeterminate_check_box_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\indeterminate_check_box_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_ffffff2f_270.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_ffffff2f_270.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_ffffff5f_90.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_ffffff5f_90.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_ffffff2f_90.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_ffffff2f_90.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_e4e7eb66_180.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_e4e7eb66_180.svg]- [targetUID: 00000000-00001580] "drag_handle_e1e5e9_90.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\drag_handle_e1e5e9_90.svg]- [targetUID: 00000000-00001580] "check_box_outline_blank_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\check_box_outline_blank_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "radio_button_checked_8ab4f7_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\radio_button_checked_8ab4f7_0.svg]- [targetUID: 00000000-00001580] "expand_less_e1e5e9_180.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\expand_less_e1e5e9_180.svg]- [targetUID: 00000000-00001580] "radio_button_unchecked_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\radio_button_unchecked_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "expand_less_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\expand_less_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "chevron_right_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\chevron_right_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "horizontal_rule_e4e7eb66_90.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\horizontal_rule_e4e7eb66_90.svg]- [targetUID: 00000000-00001580] "indeterminate_check_box_8ab4f7_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\indeterminate_check_box_8ab4f7_0.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_e1e5e9_180.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_e1e5e9_180.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_ffffff5f_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_ffffff5f_0.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_ffffff2f_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_ffffff2f_0.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "vertical_line_ffffff5f_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\vertical_line_ffffff5f_0.svg]- [targetUID: 00000000-00001580] "vertical_line_ffffff35_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\vertical_line_ffffff35_0.svg]- [targetUID: 00000000-00001580] "radio_button_unchecked_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\radio_button_unchecked_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "expand_less_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\expand_less_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "check_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\check_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "horizontal_rule_e1e5e9_90.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\horizontal_rule_e1e5e9_90.svg]- [targetUID: 00000000-00001580] "horizontal_rule_e4e7eb66_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\horizontal_rule_e4e7eb66_0.svg]- [targetUID: 00000000-00001580] "arrow_drop_up_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\arrow_drop_up_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "horizontal_rule_e1e5e9_0.svg" has type "SVG Scalable Vector Graphics image"- Location: [%USERPROFILE%\.cache\qdarktheme\v2.1.0\horizontal_rule_e1e5e9_0.svg]- [targetUID: 00000000-00001580] "QtWidgets.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\QtWidgets.pyd]- [targetUID: 00000000-00001580] "QtCore.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\QtCore.pyd]- [targetUID: 00000000-00001580] "QtGui.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\QtGui.pyd]- [targetUID: 00000000-00001580] "base_library.zip" has type "Zip archive data at least v2.0 to extract compression method=store"- Location: [%TEMP%\_MEI43762\base_library.zip]- [targetUID: 00000000-00001580] "qt_gl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_gl.qm]- [targetUID: 00000000-00004376] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_decimal.pyd]- [targetUID: 00000000-00001580] "qtbase_tr.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_tr.qm]- [targetUID: 00000000-00004376] "qtbase_lg.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_lg.qm]- [targetUID: 00000000-00004376] "qt_sl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_sl.qm]- [targetUID: 00000000-00004376] "qtbase_de.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_de.qm]- [targetUID: 00000000-00004376] "qtbase_ca.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_ca.qm]- [targetUID: 00000000-00004376] "qtbase_pt_BR.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_pt_BR.qm]- [targetUID: 00000000-00004376] "qtbase_hu.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_hu.qm]- [targetUID: 00000000-00004376] "qtbase_ru.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_ru.qm]- [targetUID: 00000000-00004376] "qtbase_nl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_nl.qm]- [targetUID: 00000000-00004376] "qtbase_ka.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_ka.qm]- [targetUID: 00000000-00004376] "qtbase_sv.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_sv.qm]- [targetUID: 00000000-00004376] "qtbase_nn.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_nn.qm]- [targetUID: 00000000-00004376] "qtbase_da.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_da.qm]- [targetUID: 00000000-00004376] "qtbase_fi.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_fi.qm]- [targetUID: 00000000-00004376] "qtbase_cs.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_cs.qm]- [targetUID: 00000000-00004376] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_ssl.pyd]- [targetUID: 00000000-00001580] "qt_lt.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_lt.qm]- [targetUID: 00000000-00004376] "qtbase_bg.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_bg.qm]- [targetUID: 00000000-00004376] "qtbase_es.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_es.qm]- [targetUID: 00000000-00004376] "qtbase_pl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_pl.qm]- [targetUID: 00000000-00004376] "qtbase_it.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_it.qm]- [targetUID: 00000000-00004376] "qtbase_ar.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_ar.qm]- [targetUID: 00000000-00004376] "qtbase_fr.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_fr.qm]- [targetUID: 00000000-00004376] "qtbase_uk.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_uk.qm]- [targetUID: 00000000-00004376] "qtbase_ko.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_ko.qm]- [targetUID: 00000000-00004376] "qtbase_hr.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_hr.qm]- [targetUID: 00000000-00004376] "qtbase_fa.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_fa.qm]- [targetUID: 00000000-00004376] "qtbase_zh_CN.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_zh_CN.qm]- [targetUID: 00000000-00004376] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_lzma.pyd]- [targetUID: 00000000-00001580] "qtbase_ja.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_ja.qm]- [targetUID: 00000000-00004376] "qtbase_zh_TW.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_zh_TW.qm]- [targetUID: 00000000-00004376] "qtbase_sk.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qtbase_sk.qm]- [targetUID: 00000000-00004376] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_ctypes.pyd]- [targetUID: 00000000-00001580] "sip.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\sip.cp313-win_amd64.pyd]- [targetUID: 00000000-00001580] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_bz2.pyd]- [targetUID: 00000000-00001580] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_socket.pyd]- [targetUID: 00000000-00001580] "qt_pt_PT.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_pt_PT.qm]- [targetUID: 00000000-00004376] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_asyncio.pyd]- [targetUID: 00000000-00001580] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_hashlib.pyd]- [targetUID: 00000000-00001580] "QtSvg.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\QtSvg.pyd]- [targetUID: 00000000-00001580] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_overlapped.pyd]- [targetUID: 00000000-00001580] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_wmi.pyd]- [targetUID: 00000000-00001580] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_multiprocessing.pyd]- [targetUID: 00000000-00001580] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_queue.pyd]- [targetUID: 00000000-00001580] "qt_help_pt_BR.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_pt_BR.qm]- [targetUID: 00000000-00004376] "qt_help_cs.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_cs.qm]- [targetUID: 00000000-00004376] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_uuid.pyd]- [targetUID: 00000000-00001580] "qt_help_gl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_gl.qm]- [targetUID: 00000000-00004376] "qt_help_es.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_es.qm]- [targetUID: 00000000-00004376] "qt_help_it.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_it.qm]- [targetUID: 00000000-00004376] "qt_help_bg.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_bg.qm]- [targetUID: 00000000-00004376] "qt_help_sk.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_sk.qm]- [targetUID: 00000000-00004376] "qt_help_sl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_sl.qm]- [targetUID: 00000000-00004376] "qt_help_uk.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_uk.qm]- [targetUID: 00000000-00004376] "qt_help_pl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_pl.qm]- [targetUID: 00000000-00004376] "qt_help_ar.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_ar.qm]- [targetUID: 00000000-00004376] "qt_help_ja.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_ja.qm]- [targetUID: 00000000-00004376] "qt_help_de.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_de.qm]- [targetUID: 00000000-00004376] "qt_help_ca.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_ca.qm]- [targetUID: 00000000-00004376] "qt_help_ru.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_ru.qm]- [targetUID: 00000000-00004376] "qt_help_hu.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_hu.qm]- [targetUID: 00000000-00004376] "qt_help_ka.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_ka.qm]- [targetUID: 00000000-00004376] "qt_help_sv.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_sv.qm]- [targetUID: 00000000-00004376] "qt_help_nn.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_nn.qm]- [targetUID: 00000000-00004376] "qt_help_tr.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_tr.qm]- [targetUID: 00000000-00004376] "qt_help_ko.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_ko.qm]- [targetUID: 00000000-00004376] "qt_help_hr.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_hr.qm]- [targetUID: 00000000-00004376] "qt_help_zh_TW.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_zh_TW.qm]- [targetUID: 00000000-00004376] "qt_help_zh_CN.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_zh_CN.qm]- [targetUID: 00000000-00004376] "qt_help_nl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_nl.qm]- [targetUID: 00000000-00004376] "qt_help_da.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_da.qm]- [targetUID: 00000000-00004376] "qt_help_fr.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_help_fr.qm]- [targetUID: 00000000-00004376] "instagram_downloader.log" has type "Unknown"- Location: [%TEMP%\_MEI43762\instagram_downloader.log]- [targetUID: 00000000-00001580] "settings.json" has type "JSON text data"- Location: [C:\user-settings\settings.json]- [targetUID: 00000000-00001580] "qt_sv.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_sv.qm]- [targetUID: 00000000-00004376] "qt_pt_BR.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_pt_BR.qm]- [targetUID: 00000000-00004376] "qt_ar.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_ar.qm]- [targetUID: 00000000-00004376] "qt_uk.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_uk.qm]- [targetUID: 00000000-00004376] "qt_ru.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_ru.qm]- [targetUID: 00000000-00004376] "qt_hr.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_hr.qm]- [targetUID: 00000000-00004376] "qt_zh_TW.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_zh_TW.qm]- [targetUID: 00000000-00004376] "qt_pl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_pl.qm]- [targetUID: 00000000-00004376] "qt_zh_CN.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_zh_CN.qm]- [targetUID: 00000000-00004376] "qt_sk.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_sk.qm]- [targetUID: 00000000-00004376] "qt_cs.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_cs.qm]- [targetUID: 00000000-00004376] "qt_ka.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_ka.qm]- [targetUID: 00000000-00004376] "qt_ca.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_ca.qm]- [targetUID: 00000000-00004376] "qt_de.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_de.qm]- [targetUID: 00000000-00004376] "qt_nn.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_nn.qm]- [targetUID: 00000000-00004376] "qt_bg.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_bg.qm]- [targetUID: 00000000-00004376] "qt_es.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_es.qm]- [targetUID: 00000000-00004376] "qt_it.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_it.qm]- [targetUID: 00000000-00004376] "qt_fr.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_fr.qm]- [targetUID: 00000000-00004376] "qt_da.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_da.qm]- [targetUID: 00000000-00004376] "qt_fi.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_fi.qm]- [targetUID: 00000000-00004376] "qt_nl.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_nl.qm]- [targetUID: 00000000-00004376] "qt_fa.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_fa.qm]- [targetUID: 00000000-00004376] "qt_tr.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_tr.qm]- [targetUID: 00000000-00004376] "qt_ja.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_ja.qm]- [targetUID: 00000000-00004376] "qt_ko.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_ko.qm]- [targetUID: 00000000-00004376] "qt_hu.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_hu.qm]- [targetUID: 00000000-00004376] "qt_gd.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_gd.qm]- [targetUID: 00000000-00004376] "qt_lv.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_lv.qm]- [targetUID: 00000000-00004376] "qt_he.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_he.qm]- [targetUID: 00000000-00004376] "qt_lg.qm" has type "Unknown"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\translations\qt_lg.qm]- [targetUID: 00000000-00004376]3f:T841,"Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\INSTALOADER-GUI-WRAPPER_V.1.4.EXE"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY"; Key: ""; Value: "")40:T1219,"opengl32sw.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\opengl32sw.dll]- [targetUID: 00000000-00004376] "Qt6Core.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Core.dll]- [targetUID: 00000000-00001580] "Qt6Pdf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Pdf.dll]- [targetUID: 00000000-00004376] "Qt6Widgets.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Widgets.dll]- [targetUID: 00000000-00001580] "Qt6Gui.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Gui.dll]- [targetUID: 00000000-00001580] "Qt6Network.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Network.dll]- [targetUID: 00000000-00004376] "qwindows.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qwindows.dll]- [targetUID: 00000000-00001580] "Qt6Svg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Svg.dll]- [targetUID: 00000000-00001580] "qjpeg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qjpeg.dll]- [targetUID: 00000000-00001580] "qwebp.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qwebp.dll]- [targetUID: 00000000-00001580] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140.dll]- [targetUID: 00000000-00001580] "qtiff.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qtiff.dll]- [targetUID: 00000000-00001580] "MSVCP140_2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140_2.dll]- [targetUID: 00000000-00001580] "qmodernwindowsstyle.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140.dll]- [targetUID: 00000000-00001580] "qoffscreen.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qoffscreen.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\VCRUNTIME140.dll]- [targetUID: 00000000-00001580] "qtuiotouchplugin.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\generic\qtuiotouchplugin.dll]- [targetUID: 00000000-00004376] "qsvgicon.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\iconengines\qsvgicon.dll]- [targetUID: 00000000-00001580] "qminimal.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qminimal.dll]- [targetUID: 00000000-00001580] "qicns.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qicns.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001580] "qgif.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qgif.dll]- [targetUID: 00000000-00001580] "qico.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qico.dll]- [targetUID: 00000000-00001580] "qpdf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qpdf.dll]- [targetUID: 00000000-00001580]41:Te5e,"Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "INSTALOADER-GUI-WRAPPER_V.1.4"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "")42:T424,"Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\COMCTL32.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "C:\Windows\System32\imm32.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "\Device\KsecDD" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "C:\FLTLIB.DLL" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL"43:T830,"Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\MSVCP140.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\MSVCP140_1.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\MSVCP140_2.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\Qt6Core.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\Qt6Gui.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\Qt6Network.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\Qt6Pdf.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\Qt6Svg.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\Qt6Widgets.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140_1.dll" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\opengl32sw.dll"44:Te67,"Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\plugins" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\plugins\generic" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\plugins\iconengines" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\plugins\imageformats" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\plugins\platforms" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\plugins\styles" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_bg.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_ca.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_cs.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_da.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_de.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_en.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_es.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_fa.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_fi.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_fr.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_gd.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_gl.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_he.qm" "Instaloader-GUI-Wrapper_v.1.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\translations\qt_help_ar.qm"45:T1da4,file/memory contains long string with (Indicator: " bind "; File: "qtuiotouchplugin.dll") file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " accept "; File: "_socket.pyd") file/memory contains long string with (Indicator: "inet_ntoa"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostbyname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "wsastartup"; File: "_socket.pyd") file/memory contains long string with (Indicator: " send "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "qt_pt_PT.qm") file/memory contains long string with (Indicator: " connect "; File: "qt_pt_PT.qm") file/memory contains long string with (Indicator: " bind "; File: "qt_pt_PT.qm") file/memory contains long string with (Indicator: " send "; File: "qt_pt_PT.qm") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " shutdown "; File: "instagram_downloader.log") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "Instaloader-GUI-Wrapper_v.1.4.exe") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "Instaloader-GUI-Wrapper_v.1.4.exe") Found reference to API "All functions which accept a handle object also accept an integer --" (Indicator: " accept "; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp") Found reference to API "Note: The wrapped version will only accept the object format" (Indicator: " accept "; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp") Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found reference to API "does not accept an iterable for an input." (Indicator: " accept "; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found reference to API "S_IFSOCK: socket file" (Indicator: " socket "; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found reference to API "As a special case, accept None and return type(None) instead. Also wrap strings" (Indicator: " accept "; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found reference to API "connection is closed, the underlying socket is closed." (Indicator: " socket "; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000003.182558.639CA000.00000004.mdmp") Found reference to API "Cannot send input after starting communication" (Indicator: " send "; Source: "00000000-00001580.00000000.172102.63B50000.00000004.mdmp, 00000000-00001580.00000002.175944.63B50000.00000004.mdmp, 00000000-00001580.00000003.182558.63B50000.00000004.mdmp") Found reference to API "# How to send help() to stderr" (Indicator: " send "; Source: "00000000-00001580.00000000.172102.63B50000.00000004.mdmp, 00000000-00001580.00000000.172102.63E50000.00000004.mdmp, 00000000-00001580.00000002.175944.63B50000.00000004.mdmp, 00000000-00001580.00000002.175944.63E50000.00000004.mdmp, 00000000-00001580.00000003.182558.63B50000.00000004.mdmp, 00000000-00001580.00000003.182558.63E50000.00000004.mdmp") Found reference to API "Interact with process: Send data to stdin and close it." (Indicator: " send "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found reference to API "This module allows you to spawn processes, connect to their" (Indicator: " connect "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found reference to API "Raises ShutDown if the queue has been shut down." (Indicator: " shutdown "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found reference to API "*reuse_port* dictates whether to use the SO_REUSEPORT socket option." (Indicator: " socket "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63D35000.00000004.mdmp") Found reference to API "create an AF_INET6 socket able to accept both IPv4 or IPv6" (Indicator: " socket "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63D35000.00000004.mdmp") Found reference to API "create an AF_INET6 socket able to accept both IPv4 or IPv6" (Indicator: " accept "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63D35000.00000004.mdmp") Found reference to API "This tells the SpecifierSet if it should accept prerelease versions if" (Indicator: " accept "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found reference to API "The socket must be of SOCK_STREAM type." (Indicator: " socket "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63DA1000.00000004.mdmp") Found reference to API "Raises ShutDown if the queue has been shut down and is empty," (Indicator: " shutdown "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63DEE000.00000004.mdmp") Found reference to API "``__init__`` methods that accept ``id`` and ``name``." (Indicator: " accept "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp")46:T775,Potential IP "192.0.2.0" found in string ">>> list(summarize_address_range(IPv4Address('192.0.2.0')," Potential IP "192.0.2.130" found in string "... IPv4Address('192.0.2.130')))" Potential IPs "192.0.2.0" "192.0.2.128" found in string "[IPv4Network('192.0.2.0/25'), IPv4Network('192.0.2.128/31')," Potential IP "192.0.2.130" found in string "IPv4Network('192.0.2.130/32')]" Potential IP "100.64.0.0" found in string "``is_global`` has value opposite to :attr:`is_private`, except for the ``100.64.0.0/10``" Potential IP "192.0.2.0" found in string "'192.0.2.0/24'" Potential IPs "192.0.2.0" "255.255.255.0" found in string "'192.0.2.0/255.255.255.0'" Potential IPs "192.0.2.0" "0.0.0.255" found in string "'192.0.2.0/0.0.0.255'" Potential IP "192.0.2.1" found in string "'192.0.2.1'" Potential IPs "192.0.2.1" "255.255.255.255" found in string "'192.0.2.1/255.255.255.255'" Potential IP "192.0.2.1" found in string "'192.0.2.1/32'" Potential IP "255.0.0.0" found in string "non-zero field (e.g. /255.0.0.0 == /8) and as a hostmask if it" Potential IP "0.255.255.255" found in string "starts with a zero field (e.g. 0.255.255.255 == /8), with the" Potential IP "192.0.2.1" found in string "IPv4Network('192.0.2.1') == IPv4Network(3221225985)" Potential IP "192.0.2.1" found in string "IPv4Interface(int(IPv4Interface('192.0.2.1'))) ==" Potential IP "192.0.2.1" found in string "IPv4Interface('192.0.2.1')" "1.3.101.111" "1.3.101.110" "1.3.101.113" "1.3.101.112" Potential IP "192.0.2.0" found in string "ip1 = IPv4Network('192.0.2.0/26')" Potential IP "192.0.2.64" found in string "ip2 = IPv4Network('192.0.2.64/26')" Potential IP "192.0.2.128" found in string "ip3 = IPv4Network('192.0.2.128/26')" Potential IP "192.0.2.192" found in string "ip4 = IPv4Network('192.0.2.192/26')" Potential IP "192.0.2.0" found in string "[IPv4Network('192.0.2.0/24')]"47:Tb173,Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.combinations(iterable," - Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001580.00000000.172102.63E50000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/eycz$ycziycz@)ycz0mxczeycz$yczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeycz0.oczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeycz0.oczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeycz$yczeycz$yczeyczywcz$yczeycz$yczeycz$yczeycz$yczeycz$yczeycz$yczbr" - Source: "00000000-00001580.00000000.172102.63E50000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00001580.00000000.172102.63F50000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)qidzc:\users\fyapzq3\appdata\local\temp\_mei43762\__future__.pyc:\users\fyapzq3\appdata\local\temp\_mei43762\setuptools\_vendorerczvidzvidzwidzercz" - Source: "00000000-00001580.00000000.172102.63F50000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00001580.00000000.172102.63F50000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001580.00000000.172102.64450000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml>yczdistutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00001580.00000000.172102.64450000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/5pwsdzpwsdzpsdz@psdz" - Source: "00000000-00001580.00000000.172102.64450000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00001580.00000000.172102.64450000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.uidzuidza" - Source: "00000000-00001580.00000000.172102.64CC0000.00000004.mdmp") Found URL "https://github.com/pypa/packagingbsd-2-clause" - Source: "00000000-00001580.00000000.172102.64CC0000.00000004.mdmp") Found URL "https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbcaelf" - Source: "00000000-00001580.00000000.172102.64CC0000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmlthis" - Source: "00000000-00001580.00000000.172102.64CC0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00001580.00000000.172102.64CC0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\fyapzq3\appdata\local\temp\_mei43762\setuptools\_distutils\log.pygiven" - Source: "00000000-00001580.00000000.172102.64CC0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.eyczuidzuidzeyczeyczeyczeyczeyczeyczeyczeyczerr_handler" - Source: "00000000-00001580.00000000.172102.64CC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expressiondistribution._finalize_license_filessetuptools._entry_pointsdistribution._expand_patternsspecifications/glob-patterns/please" - Source: "00000000-00001580.00000000.172102.64DC0000.00000004.mdmp") Found URL "http://foo/bar.tar.gz')>>>" - Source: "00000000-00001580.00000000.172102.64DC0000.00000004.mdmp") Found URL "http://foo/bar.tgz')>>>" - Source: "00000000-00001580.00000000.172102.64DC0000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00001580.00000000.172102.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/eycz>>>" - Source: "00000000-00001580.00000000.172102.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00001580.00000000.172102.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001580.00000000.172102.64DC0000.00000004.mdmp") Found URL "https://retry_https_basic_authprompt_user_passwdenter" - Source: "00000000-00001580.00000000.172102.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00001580.00000000.172102.64EC0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001580.00000000.172102.64EC0000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00001580.00000000.172102.64EC0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001580.00000000.172102.64FC0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/9" - Source: "00000000-00001580.00000000.172102.64FC0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001580.00000000.172102.64FC0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00001580.00000000.172102.64FC0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/" - Source: "00000000-00001580.00000000.172102.64FC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/tool_table_correspondence_reset_previously_defined_guess_content_type..undefined" - Source: "00000000-00001580.00000000.172102.650C0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00001580.00000000.172102.650C0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/description-content-typephidz0myczsingmultiprocessing\spawn.pymultiprocessing\context.pycannot" - Source: "00000000-00001580.00000000.172102.650C0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00001580.00000000.172102.650C0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)pc4dz0cidz" - Source: "00000000-00001580.00000000.172102.650C0000.00000004.mdmp") Found URL "https://%2/" - Source: "00000000-00001580.00000000.172102.BAE86000.00000002.mdmp") Found URL "https://%3/" - Source: "00000000-00001580.00000000.172102.BAE86000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00001580.00000000.172102.BC04F000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001580.00000001.174023.636F0000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.combinations(iterable," - Source: "00000000-00001580.00000001.174023.636F0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001580.00000001.174023.636F0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001580.00000001.174023.63900000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001580.00000001.174023.63900000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001580.00000001.174023.63900000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001580.00000001.174023.63900000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001580.00000001.174023.63900000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001580.00000001.174023.63900000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001580.00000001.174023.63C50000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00001580.00000001.174023.63C50000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00001580.00000001.174023.63C50000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00001580.00000001.174023.63C50000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001580.00000001.174023.64450000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml>yczdistutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00001580.00000001.174023.64450000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/5pwsdzpwsdzpsdz@psdz" - Source: "00000000-00001580.00000001.174023.64450000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00001580.00000001.174023.64450000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00001580.00000001.174023.64EC0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001580.00000001.174023.64EC0000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00001580.00000001.174023.64EC0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00001580.00000001.174023.65520000.00000004.mdmp") Found URL "https://www.instagram.com/explore/instaloader.get_explore_postsp;zczusezinstaloader.get_hashtag_postsdownload" - Source: "00000000-00001580.00000001.174023.65520000.00000004.mdmp") Found URL "https://proxyschemeunknown.__init__ntez00yczftezheaderparsingerror.__init__putezpktez0utez1ycz1ycz0qtezpotezqtezutez0htezp_tez" - Source: "00000000-00001580.00000001.174023.65520000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001580.00000001.174023.65520000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00001580.00000001.174023.65520000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/3290@']ez&]ez']ez']ezpn^ez0q^ez0b^ez0q^ezpz^ezt^ez" - Source: "00000000-00001580.00000001.174023.65520000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00001580.00000001.174023.65520000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00001580.00000001.174023.65520000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00001580.00000001.174023.65620000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00001580.00000001.174023.65620000.00000004.mdmp") Found URL "https://github.com/marhensa/" - Source: "00000000-00001580.00000001.174023.65E4D000.00000004.mdmp") Found URL "https://instaloader.github.io/" - Source: "00000000-00001580.00000001.174023.65E4D000.00000004.mdmp") Found URL "https://www.instagram.com/username/stories/highlights/12345078991234567/.using" - Source: "00000000-00001580.00000001.174023.65E4D000.00000004.mdmp") Found URL "https://github.com/marhensa/g.dllaleinfo9:;<=>?9:;<=>?@abcdefghi9:;<=>?9:;<=>?9:;<=>?9:;<=>?@abcdefghi" - Source: "00000000-00001580.00000001.174023.66049000.00000004.mdmp") Found URL "http://www.agfamonotype.com/html/designer/des_index.htmlttp://www.agfamonotype.com/html/designer/des_index.htmlc:\windows\fonts\segoeui.ttfc:\windows\fonts\segoeuisl.ttfc:\windows\fonts\segoeuil.ttfc:\windows\fonts\seguisb.ttfc:\windows\fonts\segoeuii.ttfc:\windows\fonts\seguisli.ttfc:\windows\fonts\seguili.ttfc:\windows\fonts\segoeuib.ttfc:\windows\fonts\segoeuiz.ttfc:\windows\fonts\arlrdbd.ttfc:\windows\fonts\arialni.ttfc:\windows\fonts\bell.ttfc:\windows\fonts\arialuni.ttfc:\windows\fonts\arial.ttfc:\windows\fonts\candarali.ttfc:\windows\fonts\seguibl.ttfc:\windows\fonts\arialn.ttfc:\windows\fonts\arialnb.ttfc:\windows\fonts\ariblk.ttfc:\windows\fonts\arialnbi.ttfc:\windows\fonts\baskvill.ttfc:\windows\fonts\agencyr.ttfc:\windows\fonts\bauhs93.ttfc:\windows\fonts\bellb.ttfc:\windows\fonts\ariali.ttfc:\windows\fonts\arialbd.ttfc:\windows\fonts\belli.ttfc:\windows\fonts\arialbi.ttfc:\windows\fonts\agencyb.ttfc:\windows\fonts\alger.ttfc:\windows\fonts\seguibli.ttfarialbi.ttfarialni.ttfarialuni.ttfbod_cb.ttfbod_bi.ttfitcblkad.ttfarlrdbd.ttfarialbd.ttfarial.ttfbaskvill.ttfbelli.ttfbod_cr.ttfbrlnsb.ttfbauhs93.ttfschlbki.ttfariali.ttfariblk.ttfbod_blai.ttfbod_cbi.ttfarialnb.ttfarialnbi.ttfbod_ci.ttfbod_pstc.ttfalger.ttfbod_b.ttfantquai.ttfbod_r.ttfagencyb.ttfantquabi.ttfbkant.ttf.ttfagencyr.ttfantquab.ttffelixti.ttfbellb.ttfbrlnsr.ttfbod_blar.ttfbell.ttfarialn.ttfbrlnsdb.ttfbernhc.ttfbod_i.ttfu" - Source: "00000000-00001580.00000001.174023.67150000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00001580.00000001.174023.BC7CF000.00000002.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00001580.00000001.174023.C0D16000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001580.00000002.175944.63E50000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/eycz$ycziycz@)ycz0mxczeycz$yczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeycz0.oczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeycz0.oczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeyczeycz$yczeycz$yczeyczywcz$yczeycz$yczeycz$yczeycz$yczeycz$yczeycz$yczbr" - Source: "00000000-00001580.00000002.175944.63E50000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00001580.00000002.175944.63F50000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)qidzc:\users\fyapzq3\appdata\local\temp\_mei43762\__future__.pyc:\users\fyapzq3\appdata\local\temp\_mei43762\setuptools\_vendorerczvidzvidzwidzercz" - Source: "00000000-00001580.00000002.175944.63F50000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00001580.00000002.175944.63F50000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.uidzuidza" - Source: "00000000-00001580.00000002.175944.64CC0000.00000004.mdmp") Found URL "https://github.com/pypa/packagingbsd-2-clause" - Source: "00000000-00001580.00000002.175944.64CC0000.00000004.mdmp") Found URL "https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbcaelf" - Source: "00000000-00001580.00000002.175944.64CC0000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmlthis" - Source: "00000000-00001580.00000002.175944.64CC0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00001580.00000002.175944.64CC0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\fyapzq3\appdata\local\temp\_mei43762\setuptools\_distutils\log.pygiven" - Source: "00000000-00001580.00000002.175944.64CC0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.eyczuidzuidzeyczeyczeyczeyczeyczeyczeyczeycz@_ezerr_handler" - Source: "00000000-00001580.00000002.175944.64CC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expressiondistribution._finalize_license_filessetuptools._entry_pointsdistribution._expand_patternsspecifications/glob-patterns/please" - Source: "00000000-00001580.00000002.175944.64DC0000.00000004.mdmp") Found URL "http://foo/bar.tar.gz')>>>" - Source: "00000000-00001580.00000002.175944.64DC0000.00000004.mdmp") Found URL "http://foo/bar.tgz')>>>" - Source: "00000000-00001580.00000002.175944.64DC0000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00001580.00000002.175944.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/eycz>>>" - Source: "00000000-00001580.00000002.175944.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00001580.00000002.175944.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001580.00000002.175944.64DC0000.00000004.mdmp") Found URL "https://retry_https_basic_authprompt_user_passwdenter" - Source: "00000000-00001580.00000002.175944.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001580.00000002.175944.64FC0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/9" - Source: "00000000-00001580.00000002.175944.64FC0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001580.00000002.175944.64FC0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00001580.00000002.175944.64FC0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/" - Source: "00000000-00001580.00000002.175944.64FC0000.00000004.mdmp") Found URL "https://ko-fi.com/marhensa" - Source: "00000000-00001580.00000002.175944.650C0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/tool_table_correspondence_reset_previously_defined_guess_content_type..undefined" - Source: "00000000-00001580.00000002.175944.650C0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00001580.00000002.175944.650C0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/description-content-typephidz0myczsingmultiprocessing\spawn.pymultiprocessing\context.pycannot" - Source: "00000000-00001580.00000002.175944.650C0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/@l&ez0k'ez$zczeycz^&ezreturns" - Source: "00000000-00001580.00000002.175944.650C0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)pc4dzp" - Source: "00000000-00001580.00000002.175944.650C0000.00000004.mdmp") Found URL "https://gist.github.com/bgusach/a967e0587d6e01e889fd1d776c5f3729.args:" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://www.instagram.com/p/xyzabc123/" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://github.com/marhensa/" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539makes" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://github.com/marhensa/instaloader-gui-wrapper" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://www.instagram.com/username/stories/highlights/12345678991234567/.f$ezg$ezg$ezg$ez0wsez@m)ezeycz3!dzyield" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://instaloader.github.io/" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920highlightscontent" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://maps.google.com/maps?q=" - Source: "00000000-00001580.00000002.175944.651C0000.00000004.mdmp") Found URL "https://www.instagram.com/p/" - Source: "00000000-00001580.00000002.175944.65720000.00000004.mdmp") Found URL "https://www.instagram.com/" - Source: "00000000-00001580.00000002.175944.65720000.00000004.mdmp") Found URL "https://www.instagram.com/explore/tags/hashtag.get_posts_resumable0esez_tez++1ftopsearchresults.__init__topsearchresults.get_profilestopsearchresults.get_prefixed_usernames0ycz0%zczpbyezhteztopsearchresults.get_locations0" - Source: "00000000-00001580.00000002.175944.65720000.00000004.mdmp") Found URL "https://github.com/marhensa/" - Source: "00000000-00001580.00000002.175944.65E4D000.00000004.mdmp") Found URL "https://instaloader.github.io/" - Source: "00000000-00001580.00000002.175944.65E4D000.00000004.mdmp") Found URL "https://www.instagram.com/username/stories/highlights/12345078991234567/.using" - Source: "00000000-00001580.00000002.175944.65E4D000.00000004.mdmp") Found URL "https://github.com/marhensa/g.dllaleinfo9:;<=>?9:;<=>?@abcdefghi9:;<=>?9:;<=>?9:;<=>?9:;<=>?@abcdefghi" - Source: "00000000-00001580.00000002.175944.66049000.00000004.mdmp") Found URL "http://www.agfamonotype.com/html/designer/des_index.htmlttp://www.agfamonotype.com/html/designer/des_index.htmlc:\windows\fonts\segoeui.ttfc:\windows\fonts\segoeuisl.ttfc:\windows\fonts\segoeuil.ttfc:\windows\fonts\seguisb.ttfc:\windows\fonts\segoeuii.ttfc:\windows\fonts\seguisli.ttfc:\windows\fonts\seguili.ttfc:\windows\fonts\segoeuib.ttfc:\windows\fonts\segoeuiz.ttfc:\windows\fonts\arlrdbd.ttfc:\windows\fonts\arialni.ttfc:\windows\fonts\bell.ttfc:\windows\fonts\arialuni.ttfc:\windows\fonts\arial.ttfc:\windows\fonts\candarali.ttfc:\windows\fonts\seguibl.ttfc:\windows\fonts\arialn.ttfc:\windows\fonts\arialnb.ttfc:\windows\fonts\ariblk.ttfc:\windows\fonts\arialnbi.ttfc:\windows\fonts\baskvill.ttfc:\windows\fonts\agencyr.ttfc:\windows\fonts\bauhs93.ttfc:\windows\fonts\bellb.ttfc:\windows\fonts\ariali.ttfc:\windows\fonts\arialbd.ttfc:\windows\fonts\belli.ttfc:\windows\fonts\arialbi.ttfc:\windows\fonts\agencyb.ttfc:\windows\fonts\alger.ttfc:\windows\fonts\seguibli.ttfarialbi.ttfarialni.ttfarialuni.ttfbod_cb.ttfbod_bi.ttfitcblkad.ttfarlrdbd.ttfarialbd.ttfarial.ttfbaskvill.ttfbelli.ttfbod_cr.ttfbrlnsb.ttfbauhs93.ttfschlbki.ttfariali.ttfariblk.ttfbod_blai.ttfbod_cbi.ttfarialnb.ttfarialnbi.ttfbod_ci.ttfbod_pstc.ttfalger.ttfbod_b.ttfantquai.ttfbod_r.ttfagencyb.ttfantquabi.ttfbkant.ttf.ttfagencyr.ttfantquab.ttffelixti.ttfbellb.ttfbrlnsr.ttfbod_blar.ttfbell.ttfarialn.ttfbrlnsdb.ttfbernhc.ttfbod_i.ttfu" - Source: "00000000-00001580.00000002.175944.67150000.00000004.mdmp") Found URL "http://www.color.org:/qpdf/srgb2014.icc" - Source: "00000000-00001580.00000002.175944.BB76F000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespaceadobe:ns:meta/http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00001580.00000002.175944.BB76F000.00000002.mdmp") Found URL "https://doc.qt.io/qt-6/highdpi.html" - Source: "00000000-00001580.00000002.175944.BF9AD000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.ztczftczpitczcombinations(iterable," - Source: "00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001580.00000003.182558.6390B000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001580.00000003.182558.63924000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001580.00000003.182558.63924000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001580.00000003.182558.63924000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001580.00000003.182558.63924000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001580.00000003.182558.6398B000.00000004.mdmp") Found URL "https://www-cs-faculty.stanford.edu/" - Source: "00000000-00001580.00000003.182558.63DEE000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001580.00000003.182558.63E50000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/iycz@)ycz0mxczywczbr" - Source: "00000000-00001580.00000003.182558.63E50000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00001580.00000003.182558.63F50000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)qidzc:\users\fyapzq3\appdata\local\temp\_mei43762\__future__.pyc:\users\fyapzq3\appdata\local\temp\_mei43762\setuptools\_vendorc:\users\fyapzq3\appdata\local\temp\_mei43762\_distutils_hackdistutilsmetafinder.spec_for_distutils..distutilsloaderdistutilsmetafinder.spec_for_distutils..distutilsloaderc:\users\fyapzq3\appdata\local\temp\_mei43762\importlib\abc.pydetect" - Source: "00000000-00001580.00000003.182558.63F50000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/417" - Source: "00000000-00001580.00000003.182558.63F50000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001580.00000003.182558.64050000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577916/>" - Source: "00000000-00001580.00000003.182558.640A3000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001580.00000003.182558.640C3000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001580.00000003.182558.640EE000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00001580.00000003.182558.640EE000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc7231" - Source: "00000000-00001580.00000003.182558.6415F000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00001580.00000003.182558.64177000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001580.00000003.182558.64181000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00001580.00000003.182558.641FD000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00001580.00000003.182558.64236000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00001580.00000003.182558.64236000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00001580.00000003.182558.64261000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00001580.00000003.182558.64261000.00000004.mdmp") Found URL "http://wlert_dgdez1hez8wezcreate" - Source: "00000000-00001580.00000003.182558.64261000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00001580.00000003.182558.64261000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/pyproject-toml/" - Source: "00000000-00001580.00000003.182558.64274000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00001580.00000003.182558.642E2000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00001580.00000003.182558.642E2000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00001580.00000003.182558.642E2000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00001580.00000003.182558.642E2000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00001580.00000003.182558.642E2000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2513" - Source: "00000000-00001580.00000003.182558.642F9000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00001580.00000003.182558.64306000.00000004.mdmp") Found URL "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/for" - Source: "00000000-00001580.00000003.182558.64329000.00000004.mdmp") Found URL "https://html.spec.whatwg.org/multipage/" - Source: "00000000-00001580.00000003.182558.6435B000.00000004.mdmp") Found URL "https://github.com/5yutan5/pyqtdarktheme-" - Source: "00000000-00001580.00000003.182558.6436D000.00000004.mdmp") Found URL "https://pyqtdarktheme.readthedocs.iolicense" - Source: "00000000-00001580.00000003.182558.6436D000.00000004.mdmp") Found URL "https://fonts.google.com/icons-" - Source: "00000000-00001580.00000003.182558.6436D000.00000004.mdmp") Found URL "https://github.com/google/material-design-icons-" - Source: "00000000-00001580.00000003.182558.6436D000.00000004.mdmp") Found URL "https://www.apache.org/licenses/license-2.0.txtmodifications" - Source: "00000000-00001580.00000003.182558.6436D000.00000004.mdmp") Found URL "https://github.com/google/material-design-icons/blob/master/licenseqdarkstylesheet(source" - Source: "00000000-00001580.00000003.182558.6436D000.00000004.mdmp") Found URL "https://github.com/colinduquesnoy/qdarkstylesheet-" - Source: "00000000-00001580.00000003.182558.6436D000.00000004.mdmp") Found URL "https://opensource.org/licenses/mitmodifications" - Source: "00000000-00001580.00000003.182558.6436D000.00000004.mdmp") Found URL "https://github.com/colinduquesnoy/qdarkstylesheet/blob/master/license.rst" - Source: "00000000-00001580.00000003.182558.6436D000.00000004.mdmp") Found URL "http://wwwsearch.sf.net/):" - Source: "00000000-00001580.00000003.182558.643BA000.00000004.mdmp") Found URL "https://www.rfc-editor.org/rfc/rfc8259" - Source: "00000000-00001580.00000003.182558.64401000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00001580.00000003.182558.6442E000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00001580.00000003.182558.6442E000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001580.00000003.182558.64450000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml>yczdistutilsmetafinder.spec_for_distutils..distutilsloader.create_moduledistutilsmetafinder.spec_for_distutils..distutilsloader.exec_modulesuppress" - Source: "00000000-00001580.00000003.182558.64450000.00000004.mdmp") Found URL "https://github.com/jaraco/jaraco.functools/issues/5" - Source: "00000000-00001580.00000003.182558.64450000.00000004.mdmp") Found URL "http://docs.python.org/library/itertools.html" - Source: "00000000-00001580.00000003.182558.64450000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/1024.uidzuidza" - Source: "00000000-00001580.00000003.182558.64CC0000.00000004.mdmp") Found URL "https://github.com/pypa/packagingbsd-2-clause" - Source: "00000000-00001580.00000003.182558.64CC0000.00000004.mdmp") Found URL "https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbcaelf" - Source: "00000000-00001580.00000003.182558.64CC0000.00000004.mdmp") Found URL "https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.htmlss" - Source: "00000000-00001580.00000003.182558.64CC0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0639/)." - Source: "00000000-00001580.00000003.182558.64CC0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.c:\users\fyapzq3\appdata\local\temp\_mei43762\setuptools\_distutils\log.py" - Source: "00000000-00001580.00000003.182558.64CC0000.00000004.mdmp") Found URL "https://bugs.python.org/issue44497.err_handler" - Source: "00000000-00001580.00000003.182558.64CC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/_finalize_license_expressiondistribution._finalize_license_filessetuptools._entry_pointsdistribution._expand_patternsspecifications/glob-patterns/please" - Source: "00000000-00001580.00000003.182558.64DC0000.00000004.mdmp") Found URL "http://foo/bar.tar.gz')>>>" - Source: "00000000-00001580.00000003.182558.64DC0000.00000004.mdmp") Found URL "http://foo/bar.tgz')>>>" - Source: "00000000-00001580.00000003.182558.64DC0000.00000004.mdmp") Found URL "http://example.com/foo" - Source: "00000000-00001580.00000003.182558.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/>>>" - Source: "00000000-00001580.00000003.182558.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/)." - Source: "00000000-00001580.00000003.182558.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001580.00000003.182558.64DC0000.00000004.mdmp") Found URL "https://retry_https_basic_authprompt_user_passwdenter" - Source: "00000000-00001580.00000003.182558.64DC0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00001580.00000003.182558.64EC0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001580.00000003.182558.64EC0000.00000004.mdmp") Found URL "https://pypi.org/project/build/)." - Source: "00000000-00001580.00000003.182558.64EC0000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00001580.00000003.182558.64FC0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/setuptools_enforce_deprecation" - Source: "00000000-00001580.00000003.182558.64FC0000.00000004.mdmp") Found URL "https://pypi.org/project/build/).for" - Source: "00000000-00001580.00000003.182558.64FC0000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/4894>>>" - Source: "00000000-00001580.00000003.182558.64FC0000.00000004.mdmp") Found URL "https://setuptools.pypa.io/en/latest/" - Source: "00000000-00001580.00000003.182558.64FC0000.00000004.mdmp") Found URL "https://ko-fi.com/marhensa" - Source: "00000000-00001580.00000003.182558.650C0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/tool_table_correspondence_reset_previously_defined_guess_content_type..undefined" - Source: "00000000-00001580.00000003.182558.650C0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/guides/packaging-namespace-packages/." - Source: "00000000-00001580.00000003.182558.650C0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0685/description-content-typephidz0myczsingmultiprocessing\spawn.pymultiprocessing\context.pycannot" - Source: "00000000-00001580.00000003.182558.650C0000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/@l&ez0k'ez$zczeycz^&ezreturns" - Source: "00000000-00001580.00000003.182558.650C0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/sic)" - Source: "00000000-00001580.00000003.182558.650C0000.00000004.mdmp") Found URL "https://gist.github.com/bgusach/a967e0587d6e01e889fd1d776c5f3729.args:" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://www.instagram.com/p/xyzabc123/" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://github.com/marhensa/" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539makes" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://github.com/marhensa/instaloader-gui-wrapper" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://www.instagram.com/username/stories/highlights/12345678991234567/.0m)ezpn)ezo)ez3!dzm)ezyield" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://instaloader.github.io/" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920highlightscontent" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://maps.google.com/maps?q=" - Source: "00000000-00001580.00000003.182558.651C0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00001580.00000003.182558.65520000.00000004.mdmp") Found URL "https://www.instagram.com/explore/instaloader.get_explore_postsp;zczusezinstaloader.get_hashtag_postsdownload" - Source: "00000000-00001580.00000003.182558.65520000.00000004.mdmp") Found URL "https://proxyschemeunknown.__init__ntez00yczftezheaderparsingerror.__init__&eezdwez1ycz1yczqtezutezhen" - Source: "00000000-00001580.00000003.182558.65520000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001580.00000003.182558.65520000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00001580.00000003.182558.65520000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/3290@']ez&]ez']ez']ezpn^ez0q^ez0b^ez0q^ezpz^ezt^ez" - Source: "00000000-00001580.00000003.182558.65520000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00001580.00000003.182558.65520000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00001580.00000003.182558.65520000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00001580.00000003.182558.65620000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00001580.00000003.182558.65620000.00000004.mdmp") Found URL "https://www.instagram.com/p/" - Source: "00000000-00001580.00000003.182558.65720000.00000004.mdmp") Found URL "https://www.instagram.com/" - Source: "00000000-00001580.00000003.182558.65720000.00000004.mdmp") Found URL "https://www.instagram.com/explore/tags/hashtag.get_posts_resumable$xez0esez_tez" - Source: "00000000-00001580.00000003.182558.65720000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00001580.00000003.182558.65C2B000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00001580.00000003.182558.65C2B000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00001580.00000003.182558.65C2B000.00000004.mdmp") Found URL "https://www.instagram.com/p/xyzabc123/" - Source: "00000000-00001580.00000003.182558.65C5B000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00001580.00000003.182558.65C93000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00001580.00000003.182558.65C93000.00000004.mdmp") Found URL "http://'," - Source: "00000000-00001580.00000003.182558.65CF5000.00000004.mdmp") Found URL "https://github.com/psf/requests/pull/6710" - Source: "00000000-00001580.00000003.182558.65CF5000.00000004.mdmp") Found URL "http://google.com/mail/'))" - Source: "00000000-00001580.00000003.182558.65DF7000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00001580.00000003.182558.65DF7000.00000004.mdmp") Found URL "https://instaloader.github.io/" - Source: "00000000-00001580.00000003.182558.65F3C000.00000004.mdmp") Found URL "http://www.agfamonotype.com/html/designer/des_index.htmlttp://www.agfamonotype.com/html/designer/des_index.htmlindows\fonts\segoeuiz.ttfc:\windows\fonts\arlrdbd.ttfc:\windows\fonts\arialni.ttfc:\windows\fonts\bell.ttfc:\windows\fonts\arialuni.ttfc:\windows\fonts\arial.ttfc:\windows\fonts\candarali.ttfc:\windows\fonts\seguibl.ttfc:\windows\fonts\arialn.ttfc:\windows\fonts\arialnb.ttfc:\windows\fonts\ariblk.ttfc:\windows\fonts\arialnbi.ttfc:\windows\fonts\baskvill.ttfc:\windows\fonts\agencyr.ttfc:\windows\fonts\bauhs93.ttfc:\windows\fonts\bellb.ttfc:\windows\fonts\ariali.ttfc:\windows\fonts\arialbd.ttfc:\windows\fonts\belli.ttfc:\windows\fonts\arialbi.ttfc:\windows\fonts\agencyb.ttfc:\windows\fonts\alger.ttfc:\windows\fonts\seguibli.ttfarialbi.ttfarialni.ttfarialuni.ttfbod_cb.ttfbod_bi.ttfitcblkad.ttfarlrdbd.ttfarialbd.ttfarial.ttfbaskvill.ttfbelli.ttfbod_cr.ttfbrlnsb.ttfbauhs93.ttfschlbki.ttfariali.ttfariblk.ttfbod_blai.ttfbod_cbi.ttfarialnb.ttfarialnbi.ttfbod_ci.ttfbod_pstc.ttfalger.ttfbod_b.ttfantquai.ttfbod_r.ttfagencyb.ttfantquabi.ttfbkant.ttf.ttfagencyr.ttfantquab.ttffelixti.ttfbellb.ttfbrlnsr.ttfbod_blar.ttfbell.ttfarialn.ttfbrlnsdb.ttfbernhc.ttfbod_i.ttfu" - Source: "00000000-00001580.00000003.182558.67169000.00000004.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00001580.00000003.182558.BC630000.00000002.mdmp")48:Tb13,"Instaloader-GUI-Wrapper_v.1.4.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI43762\*.* (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter base_library.zip (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter certifi (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter charset_normalizer (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter icon.ico (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter libcrypto-3-x64.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter libffi-8.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter libssl-3-x64.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter pyexpat.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter PyQt6 (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter python3.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter python313.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter select.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter setuptools (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter unicodedata.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter VCRUNTIME140.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter VCRUNTIME140_1.dll (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter _asyncio.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter _bz2.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter _ctypes.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter _decimal.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter _hashlib.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter _lzma.pyd (UID: 00000000-00001580) "Instaloader-GUI-Wrapper_v.1.4.exe" called "FindNextFileW" with parameter _multiprocessing.pyd (UID: 00000000-00001580)49:T1f91,Found string "?fromBase64@QByteArray@@SA?AV1@AEBV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z" (Indicator: "base64"; File: "Instaloader-GUI-Wrapper_v.1.4.exe") Found string "?toBase64@QByteArray@@QEBA?AV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z" (Indicator: "base64"; File: "Instaloader-GUI-Wrapper_v.1.4.exe") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "C:\Users\FYapzQ3\AppData\Local\Temp\_MEI43762\base_library.zip\encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "tarfile" (Indicator: "tarfile"; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "zipfile" (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000000.172102.63E50000.00000004.mdmp, 00000000-00001580.00000000.172102.63F50000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000002.175944.63E50000.00000004.mdmp, 00000000-00001580.00000002.175944.63F50000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63E50000.00000004.mdmp, 00000000-00001580.00000003.182558.63F50000.00000004.mdmp") Found string "encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000000.172102.63F50000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000002.175944.63F50000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63F50000.00000004.mdmp") Found string "base64_codec" (Indicator: "base64"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "setuptools._vendor.backports.tarfile.compat" (Indicator: "tarfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "setuptools._vendor.backports.tarfile.compat.py38" (Indicator: "tarfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "email.base64mime" (Indicator: "base64"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000000.172102.64EC0000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.64EC0000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.64EC0000.00000004.mdmp") Found string "setuptools._vendor.backports.tarfile" (Indicator: "tarfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "zipfile._path" (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000000.172102.63F50000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000002.175944.63F50000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63F50000.00000004.mdmp") Found string "zipfile._path.glob" (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000000.172102.63F50000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000002.175944.63F50000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63F50000.00000004.mdmp") Found string "_make_zipfile" (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "is_zipfile" (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "_unpack_zipfile" (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63999000.00000004.mdmp") Found string "_unpack_tarfile" (Indicator: "tarfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "ZipFile" (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "WSAESTALE" (Indicator: "aes"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "WSAESHUTDOWN" (Indicator: "aes"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "WSAESOCKTNOSUPPORT" (Indicator: "aes"; Source: "00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "Furthermore, some packages expect files() to return either pathlib.Path or zipfile.Path, e.g.," (Indicator: "zipfile"; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000003.182558.63924000.00000004.mdmp")4a:Ta4b,Found string "where a single '*' indicates a type variable tuple::" (Indicator: "where "; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp") Found string "where the use of '**' creates a parameter specification::" (Indicator: "where "; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp") Found string "Where there is no registered implementation for a specific type, its method" (Indicator: "where "; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "Where a nested list appears, it contains classes derived from the class" (Indicator: "where "; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found string "where 'value' is either the string to define it to or None to" (Indicator: "where "; Source: "00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp") Found string "where '*lang' may be omitted but the other parts may not be." (Indicator: "where "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found string "where T1, T2 etc. are TypeVars, which would be invalid, because" (Indicator: "where "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp") Found string "where '*lang' is omitted unless the 'lang' parameter is given a value." (Indicator: "where "; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63DA1000.00000004.mdmp") Found string "where relevant, rather than a typing.py-specific error message." (Indicator: "where "; Source: "00000000-00001580.00000000.172102.63E50000.00000004.mdmp, 00000000-00001580.00000002.175944.63E50000.00000004.mdmp, 00000000-00001580.00000003.182558.63E50000.00000004.mdmp")4b:T535,Found string "?password@QUrl@@QEBA?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z" (Indicator: "password"; File: "Instaloader-GUI-Wrapper_v.1.4.exe") Found string "secrets" (Indicator: "secret"; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp") Found string "pwd is the password to decrypt files (only used for reading)." (Indicator: "password"; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63CFA000.00000004.mdmp") Found string "Bad password for file %r" (Indicator: "password"; Source: "00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000000.172102.63E50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63E50000.00000004.mdmp, 00000000-00001580.00000003.182558.63E50000.00000004.mdmp")4c:Te8d,Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.61A49000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.61A49000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Instaloader-GUI-Wrapper_v.1.4.exe" (Indicator: "\Device\"; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000000.172102.E3FE0000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.E3FD6000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.E3FD6000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.E3FD6000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000000.172102.632E0000.00000004.mdmp, 00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.632E0000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.632E0000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.632E0000.00000004.mdmp, 00000000-00001580.00000003.182558.63E03000.00000004.mdmp, 00000000-00001580.00000003.182558.642DB000.00000004.mdmp, 00000000-00001580.00000003.182558.6442E000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000000.172102.632E0000.00000004.mdmp, 00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.632E0000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.632E0000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.632E0000.00000004.mdmp, 00000000-00001580.00000003.182558.63E03000.00000004.mdmp, 00000000-00001580.00000003.182558.642DB000.00000004.mdmp, 00000000-00001580.00000003.182558.6442E000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001580.00000000.172102.636F0000.00000004.mdmp, 00000000-00001580.00000001.174023.636F0000.00000004.mdmp, 00000000-00001580.00000003.182558.636F0000.00000004.mdmp")4d:T728,Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Instaloader-GUI-Wrapper_v.1.4.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: Qt6Network.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Qt6Network.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Qt6Network.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: Qt6Network.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Qt6Network.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: Qt6Network.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: Qt6Network.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Qt6Network.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: Qt6Network.dll] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: Qt6Network.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: Qt6Network.dll]4e:Ta76,"Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\INSTALOADER-GUI-WRAPPER_V.1.4.EXE"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")4f:T3424,"Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "01AE493E0364DD010000000000000000000000000200000000") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "5A040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D70015020200000000695303007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B010474580304931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DD3F9000DDB80010E013E010E963D010EBACD001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B0129B160032A024A032A0E39012A68A9002AB722012AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004BF4C2014C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300254B7DC00552D200355358303555F2A0157AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A0162226803625AC6016396770063BE7A0364D419016530540165C97603664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036F00BC026F9777036FB3110170FD2903710528017140A30071965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C39007A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00971C6103976AB60097748D0097F6C40098724601987F5C03992D720399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A39B8703A3B24E03A3D40803A4580200A4BA3701A5ADCF00A61CA802A644A600A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B4526303B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B7F00202B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C92FB902C9384F01C9389700C953F100CA23B700CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EF264D03F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503DF00060000000047F10000EB9E02021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C0132551E013256AE0032D45F013307F50236D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004BC836014BDE41014CAF71004D863E034F0B45014F6B680352221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A0160AA560160B9410161FC390162295101628E74036363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B0187279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F93029283510192C41401930547019369C70096390B01994664019AC657019C4027019CA553039D9FA0009F60C3009F8F6E00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703CE8A8003D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E7163001E8A4C601E9D1F500EAB94F00ED3FDC02F00E4E01F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F65FE401F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FE5BFE00FF506003010007000000E42C4C010800400100000212F8002DD8F4004B11B4007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0000") "Instaloader-GUI-Wrapper_v.1.4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "5B040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D70015020200000000695303007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B010474580304931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DD3F9000DDB80010E013E010E963D010EBACD001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B0129B160032A024A032A0E39012A68A9002AB722012AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004BF4C2014C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300254B7DC00552D200355358303555F2A0157AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A0162226803625AC6016396770063BE7A0364D419016530540165C97603664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036F00BC026F9777036FB3110170FD2903710528017140A30071965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C39007A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00971C6103976AB60097748D0097F6C40098724601987F5C03992D720399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A39B8703A3B24E03A3D40803A4580200A4BA3701A5ADCF00A61CA802A644A600A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B4526303B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B7F00202B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C92FB902C9384F01C9389700C953F100CA23B700CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EF264D03F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503E000060000000047F10000EB9E02021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C0132551E013256AE0032D45F013307F50236D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004BC836014BDE41014CAF71004D863E034F0B45014F6B6803508FC40052221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A0160AA560160B9410161FC390162295101628E74036363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B0187279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F93029283510192C41401930547019369C70096390B01994664019AC657019C4027019CA553039D9FA0009F60C3009F8F6E00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703CE8A8003D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E7163001E8A4C601E9D1F500EAB94F00ED3FDC02F00E4E01F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F65FE401F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FE5BFE00FF506003010007000000E42C4C010800400100000212F8002DD8F4004B11B4007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0000")50:T1219,"opengl32sw.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\opengl32sw.dll]- [targetUID: 00000000-00004376] "Qt6Core.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Core.dll]- [targetUID: 00000000-00001580] "Qt6Pdf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Pdf.dll]- [targetUID: 00000000-00004376] "Qt6Widgets.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Widgets.dll]- [targetUID: 00000000-00001580] "Qt6Gui.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Gui.dll]- [targetUID: 00000000-00001580] "Qt6Network.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Network.dll]- [targetUID: 00000000-00004376] "qwindows.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qwindows.dll]- [targetUID: 00000000-00001580] "Qt6Svg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Svg.dll]- [targetUID: 00000000-00001580] "qjpeg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qjpeg.dll]- [targetUID: 00000000-00001580] "qwebp.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qwebp.dll]- [targetUID: 00000000-00001580] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140.dll]- [targetUID: 00000000-00001580] "qtiff.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qtiff.dll]- [targetUID: 00000000-00001580] "MSVCP140_2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140_2.dll]- [targetUID: 00000000-00001580] "qmodernwindowsstyle.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140.dll]- [targetUID: 00000000-00001580] "qoffscreen.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qoffscreen.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\VCRUNTIME140.dll]- [targetUID: 00000000-00001580] "qtuiotouchplugin.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\generic\qtuiotouchplugin.dll]- [targetUID: 00000000-00004376] "qsvgicon.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\iconengines\qsvgicon.dll]- [targetUID: 00000000-00001580] "qminimal.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qminimal.dll]- [targetUID: 00000000-00001580] "qicns.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qicns.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001580] "qgif.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qgif.dll]- [targetUID: 00000000-00001580] "qico.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qico.dll]- [targetUID: 00000000-00001580] "qpdf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qpdf.dll]- [targetUID: 00000000-00001580]51:T2133,"opengl32sw.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\opengl32sw.dll]- [targetUID: 00000000-00004376] "Qt6Core.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Core.dll]- [targetUID: 00000000-00001580] "Qt6Pdf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Pdf.dll]- [targetUID: 00000000-00004376] "Qt6Widgets.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Widgets.dll]- [targetUID: 00000000-00001580] "Qt6Gui.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Gui.dll]- [targetUID: 00000000-00001580] "Qt6Network.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Network.dll]- [targetUID: 00000000-00004376] "qwindows.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qwindows.dll]- [targetUID: 00000000-00001580] "Qt6Svg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\Qt6Svg.dll]- [targetUID: 00000000-00001580] "qjpeg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qjpeg.dll]- [targetUID: 00000000-00001580] "qwebp.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qwebp.dll]- [targetUID: 00000000-00001580] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140.dll]- [targetUID: 00000000-00001580] "qtiff.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qtiff.dll]- [targetUID: 00000000-00001580] "MSVCP140_2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140_2.dll]- [targetUID: 00000000-00001580] "qmodernwindowsstyle.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140.dll]- [targetUID: 00000000-00001580] "qoffscreen.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qoffscreen.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI43762\VCRUNTIME140.dll]- [targetUID: 00000000-00001580] "qtuiotouchplugin.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\generic\qtuiotouchplugin.dll]- [targetUID: 00000000-00004376] "qsvgicon.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\iconengines\qsvgicon.dll]- [targetUID: 00000000-00001580] "qminimal.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\platforms\qminimal.dll]- [targetUID: 00000000-00001580] "qicns.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qicns.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001580] "qgif.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qgif.dll]- [targetUID: 00000000-00001580] "qico.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qico.dll]- [targetUID: 00000000-00001580] "qpdf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qpdf.dll]- [targetUID: 00000000-00001580] "qsvg.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qsvg.dll]- [targetUID: 00000000-00001580] "qtga.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qtga.dll]- [targetUID: 00000000-00001580] "qwbmp.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\plugins\imageformats\qwbmp.dll]- [targetUID: 00000000-00001580] "MSVCP140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\Qt6\bin\MSVCP140_1.dll]- [targetUID: 00000000-00001580] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001580] "QtWidgets.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\QtWidgets.pyd]- [targetUID: 00000000-00001580] "QtCore.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\QtCore.pyd]- [targetUID: 00000000-00001580] "QtGui.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\QtGui.pyd]- [targetUID: 00000000-00001580] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_decimal.pyd]- [targetUID: 00000000-00001580] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_ssl.pyd]- [targetUID: 00000000-00001580] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_lzma.pyd]- [targetUID: 00000000-00001580] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_ctypes.pyd]- [targetUID: 00000000-00001580] "sip.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\sip.cp313-win_amd64.pyd]- [targetUID: 00000000-00001580] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_bz2.pyd]- [targetUID: 00000000-00001580] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_socket.pyd]- [targetUID: 00000000-00001580] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_asyncio.pyd]- [targetUID: 00000000-00001580] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_hashlib.pyd]- [targetUID: 00000000-00001580] "QtSvg.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\PyQt6\QtSvg.pyd]- [targetUID: 00000000-00001580] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_overlapped.pyd]- [targetUID: 00000000-00001580] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_wmi.pyd]- [targetUID: 00000000-00001580] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_multiprocessing.pyd]- [targetUID: 00000000-00001580] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_queue.pyd]- [targetUID: 00000000-00001580] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI43762\_uuid.pyd]- [targetUID: 00000000-00001580]52:T6c9,"Instaloader-GUI-Wrapper_v.1.4.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\MSVCP140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Instaloader-GUI-Wrapper_v.1.4.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\MSVCP140_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Instaloader-GUI-Wrapper_v.1.4.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\MSVCP140_2.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Instaloader-GUI-Wrapper_v.1.4.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI43762\PyQt6\Qt6\bin\Qt6Core.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...53:T51e,"Qt6Network.dll" claimed CRC 40823868 while the actual is CRC 1798381 "qwindows.dll" claimed CRC 1798381 while the actual is CRC 1013354 "Qt6Svg.dll" claimed CRC 1013354 while the actual is CRC 693970 "qjpeg.dll" claimed CRC 693970 while the actual is CRC 610825 "qwebp.dll" claimed CRC 610825 while the actual is CRC 574954 "MSVCP140.dll" claimed CRC 574954 while the actual is CRC 570439 "qtiff.dll" claimed CRC 570439 while the actual is CRC 481876 "MSVCP140_2.dll" claimed CRC 481876 while the actual is CRC 291573 "qmodernwindowsstyle.dll" claimed CRC 291573 while the actual is CRC 225996 "VCRUNTIME140.dll" claimed CRC 225996 while the actual is CRC 146072 "qoffscreen.dll" claimed CRC 146072 while the actual is CRC 140369 "VCRUNTIME140.dll" claimed CRC 140369 while the actual is CRC 118044 "qsvgicon.dll" claimed CRC 115171 while the actual is CRC 91244 "qminimal.dll" claimed CRC 91244 while the actual is CRC 87127 "qicns.dll" claimed CRC 87127 while the actual is CRC 89774 "VCRUNTIME140_1.dll" claimed CRC 89774 while the actual is CRC 57827 "qgif.dll" claimed CRC 57827 while the actual is CRC 68930 "qico.dll" claimed CRC 68930 while the actual is CRC 52158 "qpdf.dll" claimed CRC 52158 while the actual is CRC 55156 "qsvg.dll" claimed CRC 55156 while the actual is CRC 7543254:T1044,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAL+klEQVR4Xq2X91NUabrH+4/YurVbW7s7u7OmccYZEXUNCEKTBQSzjugaETCCoIhiwDCCjAKioCDBAKgwRnJuJOfY5BwkY9M0CH727W713qq5P926D3yr3z79Pef5PuE85z0SiTAvL1B/qu2gUy3OR+UcdmnA2b2O42dqcPOs55xXHRcv1HL1Yh3XL9fie7kGf+9q/L3KCTpXzp3TAi5ifbyMIOdSgg6U4r+rkIBtJdyxK+OuZRmBZrKvfryE088LrXPHvRk4OMhxONSK09FOHI914OzSzrGT7bi6tnDKpYVzJ5u56NbEVbdGbrg1cNNVTsAJOYFH6glyrOfugTqC99QSbF9DyPZaQrfUEGpXTbhVFVEWNUQalxFhls8Ny1can16SzyIcHUtw3C3HeV83e7dXsc++mt1bK9luXcZ2i2J2WxdxyK6Io3aFnNpUgOeGd5y3lXHRJocr62Rcs5Dha5qDn4mMm0ZZ+Otncmt5Gjd1UrmzLJMHBjlEGOTy0CCbl6ZVPDbNJnDTaxG5+PfyysB5SxEndnbgtKGCI1uqcLAq48jGEu5dbyQnsZeGqmH62hUMdCsY7lMyIjAqMKZG7wRjPVqMCox0fmCoZZyu4vdUx7WR5lHGY6NUnqxJ56lxFs/WZpBkXkG0WYY2ejcRzWm7OlwsSnEXER8zLMBHZKRdPsL/l/VXD5KwK4s4vWRemabzyiidN6IfnlmkIvEwz+W8RQXnjAvwWJOL//58lB9UmhOnp2eoyGwm4W4hzy5nEXMmneiTycS4JPD8ZCLxrom8dE3SwiWR127JJHimkuKdQe7dPBpzmpmd/aS51sSQkhT7NF4bJpFgmkKaKN0LsxQkFy1yRA2L8DbM4LJJCt1NQ5oT3ncOE7jvN87phnNZJxwfnUhR0yhuL4kiRI0FDwib/4CIeQ94OD+cmMUPiVZDcGIEHi9+QKROKG8Ov+DDwLg2E2W9JBq/JtUsmWwbGa+tRAau24qGsc3Fe81r4rwKtJGrPhLq8JJfdB8SbhZPlMlznhg/46k0lnijp8StjSHLKYW8kxkUuGbwziGFFINY0o2ekyF9TpYaxvFkmvxG/E8RZLolMDszK678iUKXLFL1X/Fuo4xk23Qkt7ZmcX9TFtdXP6ckXq7m0FTQzq2VETw2F46NYnhq+IR4g0eido95oRtBgWjc/2mfxF+xSzIZy8PJkT5GJvi5RtHIjGN5ZxZHwpooBur7NNzmqGrS9eIp2pZDxiZRgpDd6URtz+CmiKrxXYeGVPSkjNAVD4gzj+Y3o4e8MYwi0TCSVGkUCToh1IcWaniz07MaqK3OJ5PspXfJN40kz1iNKApMHlNoEU2mXjjtCfUaXk9KM5n6TynbLSP75zQkUQ5pRNsnc0ec0FXVoyHl38nlySpRP4tHJEojSDV6QIZhGNnSB6QuCaQ+OFfD+yTSqoba6q8lkb/sFqWmoZSYCJiGiXU4pZYPeacXRkt0uYY38K6dnLWxVO3NIW+fKEH0niR+25dIqGUE/fJ+DSnPL534lcGkmoeTLr1PtmEIuYbB5BuHkK3zK43BOb8T0PjLW8qW+1JpdpdKUwGzYIEQqtaFU6AXTHNkkYY3XNpFnkks9U655Ox4g+SZbRyvrOJ4KA0VA2RQQyq+kUrC6kCyLe4jkwrHRncoMrxNqfQO+Tq+NIdk/U5Ai89ralZco948kFrT29SYB1FteYda6xBK9YNojdCWbbiiG9maSGpF/fNthYBXW5+TJBonZr4fww3aDJT7vBFR+1Foc5ciiwDKLQNFVP7iooGUL7tGe0jG7wS0+bykXu8KTTYBNKzzR25zmzqrIOrsQqgwDKAlWKbhDYkGz/qLP7WWCeRvEQISd0STJdL04gdvRuXaHqi6FEuejjvlFpepNL9IlcFp6ow8aDD2pH71GbrD0n4noN3vJfKVXjSsvYzcwJv6Vd7IjXyoN/KlfP4Fmm8kaQXktZD7Nz/q178lf/MLJBl7wim0DSJtmQfjTd0akvxqFGVLHagzPEbdupMMvM5lNLuU4dcymqXO9AQ9+yqALxk4E4Fcz4Ohl4WMZlQzEJ2LfPlZGnTPU/mtB61+WgEj+S3k//0a8vWvKNkiBBTt96d62zVk+k4oWro0pGbf+8j1d9Ky7gANNvtR9r/XHFfbaFoO3SFR2i+zs1oIa70Uzqis6itvvKGL6iUuNP3rLNVz3WnxS9AcH8lvouAf3jStj6dYLaDM8SrN//akzGwXE63aOdBx6zatJlZ0b95Bh6U18p/3MDkgRvQn7VyfVii+OvpiU4oJ7UJQPrT3UbLiBPLvD9O44jTVc1xo83uj+VktoOTbM7TaxYgMxCORH/ei8+BRam03oGxr05B6bv9Kt81a+nda029vTfd6fZrdnfmomvoa8f9qQqBqXEHFek8a5h2gbZkrTcvcqZlzjI6bbzWUkfxGSue40b4hkvItT5G0up2g33kvTVvNmWxv1pD6713n/dZlDO83ZnivIaMOxvRuWkKH31k0E31m5ms2vjhW98LMxxnqnLxpXLiDrhVHadM5SuuyU9TOOUJngLYEo0JA+TxXOmzDqNwSiaTnlAMjx7bQ/rMeyuY6DWkg/Aoj9gv54LyKD07/QuG0nIkjq+nbNo/eR35apzMfv7gX6xl15mm94kPzEnP6pHvoWrmfDl1nTRbq5zjTGaQVMJbXQKUQ0Gl9j5pNYUgGTu1gwtWS3t2LUNRpp9VYnB8fDnyD8uRPKF2+/4wfULkups/+G96nPNLwPgkRaqitOyKYNoPlDK7fQK/JZnoMdtG58iCdK44jn+sobt1UDW8otYqKeS50rhNDyioYyegZa6ZPGTC4/+8oShI1pIncxyiO/wnV2YWoPOYxeWYeKjU8FqByX0CP4I4Up2i4ahtIiaPDehFj26UMbjSn39qGXtPNdBnspmuNEw3fH2QwoVjToO+f51Ex9ygdZgHUrAtE8uGsIZ/OLGHU8b8YS/DXXHC6vxHFpTlMec9FdUWIuCIcX56P6qL4vPAdk6f/Sc/RhYzV5jNUmErXjgUo9uoyvms1I1vXChFm9FnZ0mP2M51rRH8ZHGGyV7vR6fglnqq5h+mQ3hTT9SYSxTld8FrIxKk/MxhgLZpc2+WTsgCUV//M1K3vmPL/UWCxWOugurGEyetLUF5YRO/x7+hxmIvy8HcoHRej2PdZxDZjBu0s6TOxoW2pHQMxydrAJlVUmZ+n7kcX2g1uUGkkBEyc/wG8RXp/mc/wpb8yXBCtIas3GVNV0ahibVBFrEQVpsvUPSHg9k9M3lqE0vdHlN6iNzznoTj2DyYO/JUPu75hXGRjZPNSBjeZMHDwEKMJaZoGVVvj7TiqFjggX+FB+5rrVInnjWTcexHcXIjyVxHpvcW8D9RlrC798ylCyOw0M8ONzPQW8bEjh+m2DKZb0plqTEUlT0FVm4yqMglVWQKq4kRUJWniez5TLY1iG/bfd0pXXCoVi3aJ2/Ik8iUedK72odTgOpIR3xXMiqhUwYv5+GgV09Fr6A8TyLmNakT7cPq/mjry8dY2mq+LJ+nSDeKucKBtuRuNOp7ULb9AvslV7buB8v5qeKGP6qk+H1+tYyrJluF4E3rit9Kb6sFAnj9DZZEMlUczXBYrEMNQcQyDBU/EDucRA1mRvE99QP/bEPriA+h75EvnLU9aTx5EbmVGm56UPlN72vQPiQycYHTVNUr0Lmqd4yVh/O1hpp9bQo4d08L5ZNZWVO92ony3jfEsISZtHYNJFgy8Mef9C4GnUvqj1tIXakBv4Cr6runS4/ED3Ye/pcf+j/Rs/AO91n+h3+pHBtaLkW5jQ7dUTEcDB5R6F5CvOi82pIGi+cW7oVqAWkjP29NMZ+5hSmYPlYeg9rDomuNiq+MmnrWnBTzFqDsntsxeYgN4XnAEisUxmTskH4M4B4jYCbds4JIU3KR8crJg+t/rmdy+DeX6g2JCHqVF6knsJu1LqebdUJuFz2+pwibK3PhYfozpqhOo6tyZkp8RzXZW4LxYX2KiRqBaoOQCirxzKDLdUbw5zljsQcbCdjHmv5HRi+aMuBoxdshMPEtsGNoqSmkrut/C9aufL87/A7Z12TfflRehAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792879738195,"unified_at":"2026-10-24T22:08:58.195Z","metadata":{"hashes":{"sha256":"3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","sha1":"6393d216a676800bee595c512b4be4b94d3c5046","md5":"ab4b4f8a98ad837f582bae3bc5542597","sha512":"9b54b400d6c686bc1b65c2a8811f36b8310a4d5983d1e790fce928f768086681dac39213781abbd3bc88ff24937691260b56c09c9b2eefa182033c55dc0b792c","ssdeep":"786432:B2NgL8XMPBMc7D6J5ZGxFDmWKU09fjz6nhcEtrJfSdIohO7Li3W4VwY0:UHkGcowFyWC9rz4hBtdaPOwW9Y","ssdeep_chunks":["786432:B2NgL8X","786432:2NgL8XM","786432:NgL8XMP","786432:gL8XMPB","786432:L8XMPBM","786432:8XMPBMc","786432:XMPBMc7","786432:MPBMc7D","786432:PBMc7D6","786432:BMc7D6J","786432:Mc7D6J5","786432:c7D6J5Z","786432:7D6J5ZG","786432:D6J5ZGx","786432:6J5ZGxF","786432:J5ZGxFD","786432:5ZGxFDm","786432:ZGxFDmW","786432:GxFDmWK","786432:xFDmWKU","786432:FDmWKU0","786432:DmWKU09","786432:mWKU09f","786432:WKU09fj","786432:KU09fjz","786432:U09fjz6","786432:09fjz6n","786432:9fjz6nh","786432:fjz6nhc","786432:jz6nhcE","786432:z6nhcEt","786432:6nhcEtr","786432:nhcEtrJ","786432:hcEtrJf","786432:cEtrJfS","786432:EtrJfSd","786432:trJfSdI","786432:rJfSdIo","786432:JfSdIoh","786432:fSdIohO","786432:SdIohO7","786432:dIohO7L","786432:IohO7Li","786432:ohO7Li3","786432:hO7Li3W","786432:O7Li3W4","786432:7Li3W4V","786432:Li3W4Vw","786432:i3W4VwY","786432:3W4VwY0","1572864:B2NgL8X","1572864:2NgL8XM","1572864:NgL8XMP","1572864:gL8XMPB","1572864:L8XMPBM","1572864:8XMPBMc","1572864:XMPBMc7","1572864:MPBMc7D","1572864:PBMc7D6","1572864:BMc7D6J","1572864:Mc7D6J5","1572864:c7D6J5Z","1572864:7D6J5ZG","1572864:D6J5ZGx","1572864:6J5ZGxF","1572864:J5ZGxFD","1572864:5ZGxFDm","1572864:ZGxFDmW","1572864:GxFDmWK","1572864:xFDmWKU","1572864:FDmWKU0","1572864:DmWKU09","1572864:mWKU09f","1572864:WKU09fj","1572864:KU09fjz","1572864:U09fjz6","1572864:09fjz6n","1572864:9fjz6nh","1572864:fjz6nhc","1572864:jz6nhcE","1572864:z6nhcEt","1572864:6nhcEtr","1572864:nhcEtrJ","1572864:hcEtrJf","1572864:cEtrJfS","1572864:EtrJfSd","1572864:trJfSdI","1572864:rJfSdIo","1572864:JfSdIoh","1572864:fSdIohO","1572864:SdIohO7","1572864:dIohO7L","1572864:IohO7Li","1572864:ohO7Li3","1572864:hO7Li3W","1572864:O7Li3W4","1572864:7Li3W4V","1572864:Li3W4Vw","1572864:i3W4VwY","1572864:3W4VwY0","786432:UHkGcow","786432:HkGcowF","786432:kGcowFy","786432:GcowFyW","786432:cowFyWC","786432:owFyWC9","786432:wFyWC9r","786432:FyWC9rz","786432:yWC9rz4","786432:WC9rz4h","786432:C9rz4hB","786432:9rz4hBt","786432:rz4hBtd","786432:z4hBtda","786432:4hBtdaP","786432:hBtdaPO","786432:BtdaPOw","786432:tdaPOwW","786432:daPOwW9","786432:aPOwW9Y"],"imphash":"dcaf48c1f10b0efa0a4472200f3850ed","pehash":"2162622e1b7961192ade0e3b13eb039a30181333"},"file_info":{"file_name":"Instaloader-GUI-Wrapper_v.1.4.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":40817114,"entropy":8,"compile_timestamp":"2026-01-04T02:41:46","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792879234000,"last_seen":1792879234000,"last_multi_scan":1792879234000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":179584,"raw_size":179712},{"name":".rdata","virtual_address":"0x2d000","virtual_size":80232,"raw_size":80384},{"name":".data","virtual_address":"0x41000","virtual_size":20656,"raw_size":3584},{"name":".pdata","virtual_address":"0x47000","virtual_size":9180,"raw_size":9216},{"name":".fptable","virtual_address":"0x4a000","virtual_size":256,"raw_size":512},{"name":".rsrc","virtual_address":"0x4b000","virtual_size":130348,"raw_size":130560},{"name":".reloc","virtual_address":"0x6b000","virtual_size":1908,"raw_size":2048}],"section_names":[".text",".rdata",".data",".pdata",".fptable",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null},"additional_metadata":[{"name":"package_manager","type":"str","values":["pyinstaller"]}]},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":85},"sandbox_signatures":{"informative_count":187,"suspicious_count":15,"malicious_count":1,"total":203},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_60.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tsVa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware_60.0","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to enumerate files/folders on disk"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to monitor clipboard data (API string)"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"YARA signature match – Public-private key pair"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"K32EnumProcessModules\" (Indicator: \"EnumProcessModules\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"%s%c%s.py\", Pattern match: \"http://schemas.microsoft.com/smi/2016/windowssettings\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$28","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001580.00000000.172102.BAE86000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001580.00000003.182558.632D0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000000.172102.64DC0000.00000004.mdmp, 00000000-00001580.00000002.175944.64DC0000.00000004.mdmp, 00000000-00001580.00000003.182558.64DC0000.00000004.mdmp\")\n Found reference to API \"standard_b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000000.172102.64DC0000.00000004.mdmp, 00000000-00001580.00000002.175944.64DC0000.00000004.mdmp, 00000000-00001580.00000003.182558.64DC0000.00000004.mdmp\")\n Found reference to API \"urlsafe_b64decodec\" (Indicator: \"b64decode\"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp\")\n Found string \"bPyQt6\\Qt6\\bin\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"setupdigetclassdevs\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004376)\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001580)\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001580)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004376)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001580)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004376)\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001580)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetVersionExA\" with parameter 9c0000000a00000000000000654a0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001580)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001580)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: Qt6Network.dll]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Instaloader-GUI-Wrapper_v.1.4.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Qt6Network.dll]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"run_query(\"SELECT * FROM students\") # OK\" (Indicator: \"select * from \"; Source: \"00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp\")\n Found string \"run_query(\"SELECT * FROM \" + literal_string) # OK\" (Indicator: \"select * from \"; Source: \"00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp\")\n Found string \"f\"SELECT * FROM students WHERE name = {arbitrary_string}\"\" (Indicator: \"select * from \"; Source: \"00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000003.182558.61990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00001580-00000C47-12580351479","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: VCRUNTIME140.DLL\n %TEMP%\\_MEI43762\\PYQT6\\QT6\\PLUGINS\\PLATFORMS\\QWINDOWS.DLL\n %TEMP%\\_MEI43762\\PYQT6\\QT6\\PLUGINS\\STYLES\\QMODERNWINDOWSSTYLE.DLL\n %TEMP%\\_MEI43762\\PYQT6\\QT6\\PLUGINS\\ICONENGINES\\QSVGICON.DLL\n VCRUNTIME140_1.DLL\n %TEMP%\\_MEI43762\\PYQT6\\QT6\\PLUGINS\\IMAGEFORMATS\\QICO.DLL\n %TEMP%\\_MEI43762\\PYQT6\\QT6\\PLUGINS\\IMAGEFORMATS\\QSVG.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" queried token user identity (UID: 00000000-00004376)\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" queried token user identity (UID: 00000000-00001580)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"base_library.zip\" copied on \"%TEMP%\\_MEI43762\\base_library.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"CreateProcessW\" with parameter \"\"C:\\Instaloader-GUI-Wrapper_v.1.4.exe\"\" - (UID: 00000000-00004376)\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" - (UID: 00000000-00001580)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00001580)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Insert a simple entry into the list of warnings filters (at the front).\" (Source: 00000000-00001580.00000000.172102.63B50000.00000004.mdmp, 00000000-00001580.00000002.175944.63B50000.00000004.mdmp, 00000000-00001580.00000003.182558.63B50000.00000004.mdmp, Indicator: \"insert a simple entry into the list of warnings filters (at the front).\"), \"Insert an entry into the list of warnings filters (at the front).\" (Source: 00000000-00001580.00000000.172102.63E50000.00000004.mdmp, 00000000-00001580.00000002.175944.63E50000.00000004.mdmp, 00000000-00001580.00000003.182558.63E50000.00000004.mdmp, Indicator: \"insert an entry into the list of warnings filters (at the front).\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: qwindows.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00001580-00000C47-12580351479\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00001580-00000C47-12580351479\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$31","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\" in Source: 00000000-00001580.00000000.172102.636F0000.00000004.mdmp\n 00000000-00001580.00000001.174023.636F0000.00000004.mdmp\n 00000000-00001580.00000003.182558.636F0000.00000004.mdmp\n \"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\Debug\" in Source: 00000000-00001580.00000000.172102.636F0000.00000004.mdmp\n 00000000-00001580.00000001.174023.636F0000.00000004.mdmp\n 00000000-00001580.00000003.182558.636F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$32","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$33","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$34","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mal@lemburg.com\"\n Pattern match: \"guido@python.org\"\n Pattern match: \"ping@lfw.org\"\n Pattern match: \"nadeem.vawda@gmail.com\"\n Pattern match: \"yselivanov@sprymix.com\"\n Pattern match: \"ks_in@devanagari.utf\"\n Pattern match: \"sd_in@devanagari.utf\"\n Pattern match: \"info@egenix.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688\" (Indicator: \"github.com\")\n \"https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25\" (Indicator: \"github.com\")\n \"https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312\" (Indicator: \"github.com\")\n \"argument types, see https://github.com/python/cpython/issues/86361.\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at D6AA0000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E5870000\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E5320000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E5870000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E7180000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E7180000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a363e5f97f0000@ntdll.dll\"\n \"220023000000000038a363e5f97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$37","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$38","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$39","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"Qt6Core.dll\" : \"874\" [Source: Qt6Network.dll]\n Observed large number of imported APIs from \"Qt6Core.dll\" : \"572\" [Source: qwindows.dll]\n Observed large number of imported APIs from \"Qt6Gui.dll\" : \"888\" [Source: qwindows.dll]\n Observed large number of imported APIs from \"Qt6Core.dll\" : \"348\" [Source: Qt6Svg.dll]\n Observed large number of imported APIs from \"Qt6Gui.dll\" : \"344\" [Source: Qt6Svg.dll]\n Observed large number of imported APIs from \"Qt6Gui.dll\" : \"228\" [Source: qmodernwindowsstyle.dll]\n Observed large number of imported APIs from \"Qt6Widgets.dll\" : \"205\" [Source: qmodernwindowsstyle.dll]\n Observed large number of imported APIs from \"Qt6Gui.dll\" : \"254\" [Source: qoffscreen.dll]\n Observed large number of imported APIs from \"Qt6Gui.dll\" : \"201\" [Source: qminimal.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$3a","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x10e200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x10e15d\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$3c","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00001580-00000BC0-1110650027]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00001580-00000C47-12580351479]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" [Source: 00000000-00001580-00000C47-12580351479]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Instaloader-GUI-Wrapper_v.1.4.exe\" (UID: 00000000-00001580) was launched with new environment variables: \"_PYI_ARCHIVE_FILE=\"C:\\Instaloader-GUI-Wrapper_v.1.4.exe\", USERDNSDOMAIN=\"7656xzDlc4Pi65d\", _PYI_APPLICATION_HOME_DIR=\"%TEMP%\\_MEI43762\", _PYI_PARENT_PROCESS_LEVEL=\"0\"\"\n Process \"Instaloader-GUI-Wrapper_v.1.4.exe\" (UID: 00000000-00001580) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"cmd.exe\" (UID: 00000000-00008280) was launched with new environment variables: \"QML2_IMPORT_PATH=\"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\qml\", QT_PLUGIN_PATH=\"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\"\"\n Process \"cmd.exe\" (UID: 00000000-00008280) was launched with modified environment variables: \"Path, _PYI_PARENT_PROCESS_LEVEL\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Instaloader-GUI-Wrapper_v.1.4.exe\" (UID: 00000000-00001580)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00008280)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Instaloader-GUI-Wrapper_v.1.4.exe\" (UID: 00000000-00001580)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00008280)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI43762\\PyQt6\\Qt6\\bin\\MSVCP140.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3e","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$40","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" queries basic process information of the \"C:\\Instaloader-GUI-Wrapper_v.1.4.exe\" (UID: 4376)\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" queries basic process information of the \"C:\\Instaloader-GUI-Wrapper_v.1.4.exe\" (UID: 1580)\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 1580)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 8280)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" reads file \"c:\\instaloader-gui-wrapper_v.1.4.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Able to retrieve information set for devices (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Calls an API typically used to find device information\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei43762\\pyqt6\\qt6\\bin\\msvcp140.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI43762\\instagram_downloader.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping of the 3i\" (Indicator: \"ping \"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpGetDefaultProxyConfiguration\" (Indicator: \"WinHttpGetDefaultProxyConfiguration\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WinHttpGetIEProxyConfigForCurrentUser\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"nhn_mx.utf-8\" [Source: 00000000-00001580.00000000.172102.63B50000.00000004.mdmp\n 00000000-00001580.00000002.175944.63B50000.00000004.mdmp\n 00000000-00001580.00000003.182558.63B50000.00000004.mdmp]\n Observed email domain:\"es_mx.iso8859-1\" [Source: 00000000-00001580.00000000.172102.63B50000.00000004.mdmp\n 00000000-00001580.00000002.175944.63B50000.00000004.mdmp\n 00000000-00001580.00000003.182558.63B50000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 client library\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63DA1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"Qt6Pdf.dll\"\n YARA signature for AES encryption matched on process \"00000000-00001580\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"opengl32sw.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Public-private key pair","description":"YARA signature for public-private key pair used in file \"Qt6Network.dll\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-122","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on process \"00000000-00004376\"\n YARA signature for file using Zlib compression matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Instaloader-GUI-Wrapper_v.1.4.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"Instaloader-GUI-Wrapper_v.1.4.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"Instaloader-GUI-Wrapper_v.1.4.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at DCE50000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: qwindows.dll)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir - A directory to create this temp dir in. (see mkdtemp)\" (Indicator: \"dir \"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63C50000.00000004.mdmp, 00000000-00001580.00000003.182558.63D35000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.D3F83000.00000002.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Route attribute access on a class to __getattr__.\" (Indicator: \"route\"; Source: \"00000000-00001580.00000000.172102.61990000.00000004.mdmp, 00000000-00001580.00000000.172102.63900000.00000004.mdmp, 00000000-00001580.00000001.174023.61990000.00000004.mdmp, 00000000-00001580.00000001.174023.63900000.00000004.mdmp, 00000000-00001580.00000002.175944.61990000.00000004.mdmp, 00000000-00001580.00000002.175944.63900000.00000004.mdmp, 00000000-00001580.00000003.182558.6394B000.00000004.mdmp\")\n Found string \"ping of the 3i\" (Indicator: \"ping\"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Instaloader-GUI-Wrapper_v.1.4.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Qt6Network.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: qwindows.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Instaloader-GUI-Wrapper_v.1.4.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"01AE493E0364DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4d","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" opened \"\\Device\\KsecDD\"\n \"cmd.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001580.00000000.172102.63800000.00000004.mdmp, 00000000-00001580.00000001.174023.63800000.00000004.mdmp, 00000000-00001580.00000003.182558.63800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$50","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"fopen\" (Source: Instaloader-GUI-Wrapper_v.1.4.exe, API is part of module: MSVCRT.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: Instaloader-GUI-Wrapper_v.1.4.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \"fothk\" has very low entropy (0.02)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" has section name .rsrc with entropy \"7.993753795825556\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/24 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" has resource with unusual entropy \"RT_ICON:7.827492305379126\"\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" has resource with unusual entropy \"RT_ICON:7.929601983021212\"\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" has resource with unusual entropy \"RT_ICON:7.950379532852187\"\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" has resource with unusual entropy \"RT_ICON:7.971758015269924\"\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" has resource with unusual entropy \"RT_ICON:7.988826202695216\"\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" has resource with unusual entropy \"RT_ICON:7.994170206143582\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" writes archive file \"%TEMP%\\_MEI43762\\base_library.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$51","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$52","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"5\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"Found string \"* RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518\" (Indicator: \"webdav\"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp\")\n Found string \"* RFC 5842: Binding Extensions to WebDAV\" (Indicator: \"webdav\"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp, 00000000-00001580.00000001.174023.63C50000.00000004.mdmp, 00000000-00001580.00000002.175944.63C50000.00000004.mdmp\")\n Found string \"5842: Binding Extensions to WebDAV\" (Indicator: \"webdav\"; Source: \"00000000-00001580.00000000.172102.63C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-476","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001580-00002713-1110693448\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10c4c\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$53","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n FindNextFileW\n GetModuleFileNameW\n GetTempPathW\n GetFileAttributesExW\n GetProcAddress\n WriteFile\n CreateProcessW\n GetCommandLineW\n Sleep\n CreateFileW\n GetModuleHandleW\n UnhandledExceptionFilter\n FindFirstFileW\n GetStartupInfoW\n GetDriveTypeW\n IsDebuggerPresent\n LoadLibraryExW\n DeleteFileW\n VirtualProtect\n GetCommandLineA\n TerminateProcess\n GetFileSizeEx\n GetModuleHandleExW\n FindFirstFileExW\n CreateDirectoryW\n LookupAccountNameW\n GetUserNameW\n RegOpenKeyExW\n SetSecurityDescriptorDacl\n RegCloseKey\n ConnectNamedPipe\n DisconnectNamedPipe\n SleepConditionVariableSRW\n SleepEx\n bind\n WSASendTo\n closesocket\n WSASocketW\n listen\n WSASend\n OpenProcess\n LoadLibraryA\n CheckRemoteDebuggerPresent\n LoadLibraryW\n ShellExecuteW\n GetUpdateRect\n GetCursorPos\n GetWindowThreadProcessId\n FindWindowA\n CreateThreadpoolWork\n CreateThreadpoolTimer\n GetNativeSystemInfo\n CreateThreadpoolWait\n CopyFileW\n GetTickCount64","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"MSVCP140_2.dll\" claims program is from Wed Jan 13 22:37:29 2066\n \"VCRUNTIME140.dll\" claims program is from Fri Jan 20 05:49:53 1978\n \"VCRUNTIME140_1.dll\" claims program is from Sat Aug 13 12:41:16 1977","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Instaloader-GUI-Wrapper_v.1.4.exe\" wrote 000011C0 bytes to a remote process \"C:\\Instaloader-GUI-Wrapper_v.1.4.exe\" (Handle: 456)\n \"Instaloader-GUI-Wrapper_v.1.4.exe\" wrote 00000008 bytes to a remote process \"C:\\Instaloader-GUI-Wrapper_v.1.4.exe\" (Handle: 456)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]}],"intel_graph":{"map":{"File:036ee98fb6b07b8c84bd23daf431c1b1dadaed1ba6ea71fa76d8e1afefad3da9":{"type":"File","value":"036ee98fb6b07b8c84bd23daf431c1b1dadaed1ba6ea71fa76d8e1afefad3da9"},"File:055e44b348868a8c125af0eda01813aedaf7da4e37e1eab09fa869d353b2da7a":{"type":"File","value":"055e44b348868a8c125af0eda01813aedaf7da4e37e1eab09fa869d353b2da7a"},"File:0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9":{"type":"File","value":"0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9"},"File:0fe05230bb3421a1ffcd91866016431f0633fc4d84aeb7ff75f6b14232b0c858":{"type":"File","value":"0fe05230bb3421a1ffcd91866016431f0633fc4d84aeb7ff75f6b14232b0c858"},"File:11f9052ad1682458731cb2793f043a094ca917f89f0448f99a41c21b4c22faea":{"type":"File","value":"11f9052ad1682458731cb2793f043a094ca917f89f0448f99a41c21b4c22faea"},"File:138701f32f1f570f46f50b6779d35d0b52175ee7eba37e6f26918321daa65d22":{"type":"File","value":"138701f32f1f570f46f50b6779d35d0b52175ee7eba37e6f26918321daa65d22"},"File:1beb8c0e41dfd83b64c189d8c13dce15affdca3ba4368196bbce8c2c4a1fcf69":{"type":"File","value":"1beb8c0e41dfd83b64c189d8c13dce15affdca3ba4368196bbce8c2c4a1fcf69"},"File:1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f":{"type":"File","value":"1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f"},"File:32e8d47268d19e09a1c2728b7d9bfb998bd6b30f4dfaf5d48c3e0b13f5263256":{"type":"File","value":"32e8d47268d19e09a1c2728b7d9bfb998bd6b30f4dfaf5d48c3e0b13f5263256"},"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d":{"type":"File","value":"3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d"},"File:3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9":{"type":"File","value":"3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9"},"File:41781308ce8cee4cd05a4ed8958761fe48dc2c5159bd114c942b953bc91f2c1d":{"type":"File","value":"41781308ce8cee4cd05a4ed8958761fe48dc2c5159bd114c942b953bc91f2c1d"},"File:5ef5489a39850ac3f0a960edcf76587e877fbb66aaf62a41e9fa267fbc39bf5e":{"type":"File","value":"5ef5489a39850ac3f0a960edcf76587e877fbb66aaf62a41e9fa267fbc39bf5e"},"File:6d9efd050375c82cec1eaae20894a56fb2191f22d41758ce920b06e0a5a7c736":{"type":"File","value":"6d9efd050375c82cec1eaae20894a56fb2191f22d41758ce920b06e0a5a7c736"},"File:84f7391fb8cd5a9228d3d38ebcbf957e6c7cdc789981e7a4e6f671f6ace529ca":{"type":"File","value":"84f7391fb8cd5a9228d3d38ebcbf957e6c7cdc789981e7a4e6f671f6ace529ca"},"File:8b068e0a7d1d99a5d18c8cf131fd1ee12bd94fcbb4f8a0ddd8911c9bd7135c24":{"type":"File","value":"8b068e0a7d1d99a5d18c8cf131fd1ee12bd94fcbb4f8a0ddd8911c9bd7135c24"},"File:9d10186aa74cdb50e499b69a6a78e0a0b0398615fb1f0a4769b909539bf4fab4":{"type":"File","value":"9d10186aa74cdb50e499b69a6a78e0a0b0398615fb1f0a4769b909539bf4fab4"},"File:a9d019fa4d8d8b9b4d14c9faff2459f4a1b450ae6bdc9193c53106544cb8c92b":{"type":"File","value":"a9d019fa4d8d8b9b4d14c9faff2459f4a1b450ae6bdc9193c53106544cb8c92b"},"File:a9f940f04e2511ec6c25e083635ca7e0c88518b33745ac84beb611c0feb8d497":{"type":"File","value":"a9f940f04e2511ec6c25e083635ca7e0c88518b33745ac84beb611c0feb8d497"},"File:b472d01159a858c5b9dfe8032b9994201ecc9ab967b4173379f0b05554766196":{"type":"File","value":"b472d01159a858c5b9dfe8032b9994201ecc9ab967b4173379f0b05554766196"},"File:bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d":{"type":"File","value":"bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d"},"File:c06dccfd97576b6255b56df43b03b1eabee8c01f75b6bf6ad550057771ab7cf2":{"type":"File","value":"c06dccfd97576b6255b56df43b03b1eabee8c01f75b6bf6ad550057771ab7cf2"},"File:c0f3a53dc57682b157ad50e8c2671191c629d715871afd9b5c017a4be1f4e247":{"type":"File","value":"c0f3a53dc57682b157ad50e8c2671191c629d715871afd9b5c017a4be1f4e247"},"File:c9a88f29e2022697148baa49f85b1e8f919ce704c284af52e275103dea99c4af":{"type":"File","value":"c9a88f29e2022697148baa49f85b1e8f919ce704c284af52e275103dea99c4af"},"File:d58c61f02c2c477fd8d423259f6c51f65ed8c57c6aa2df3dd98272d47974a38c":{"type":"File","value":"d58c61f02c2c477fd8d423259f6c51f65ed8c57c6aa2df3dd98272d47974a38c"},"File:d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066":{"type":"File","value":"d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066"},"File:d625ca7e908aabafe5e0048074ea8b2c6d12f8be26e2a4889e9fd303bbb60502":{"type":"File","value":"d625ca7e908aabafe5e0048074ea8b2c6d12f8be26e2a4889e9fd303bbb60502"},"File:ddadba1f19ca590b3a2c1677da2fadcbb2115fb7c32aeab0d5fa049633995e69":{"type":"File","value":"ddadba1f19ca590b3a2c1677da2fadcbb2115fb7c32aeab0d5fa049633995e69"},"File:e94b61c2ebbaab58db6b525b79cdc78072723ea9bd8f838cd79ad850f25cc275":{"type":"File","value":"e94b61c2ebbaab58db6b525b79cdc78072723ea9bd8f838cd79ad850f25cc275"}},"chains":[{"id":"sandbox_files","root":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","edges":[{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:0fe05230bb3421a1ffcd91866016431f0633fc4d84aeb7ff75f6b14232b0c858"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:1beb8c0e41dfd83b64c189d8c13dce15affdca3ba4368196bbce8c2c4a1fcf69"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:8b068e0a7d1d99a5d18c8cf131fd1ee12bd94fcbb4f8a0ddd8911c9bd7135c24"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:b472d01159a858c5b9dfe8032b9994201ecc9ab967b4173379f0b05554766196"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:c9a88f29e2022697148baa49f85b1e8f919ce704c284af52e275103dea99c4af"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:d625ca7e908aabafe5e0048074ea8b2c6d12f8be26e2a4889e9fd303bbb60502"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:c06dccfd97576b6255b56df43b03b1eabee8c01f75b6bf6ad550057771ab7cf2"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:84f7391fb8cd5a9228d3d38ebcbf957e6c7cdc789981e7a4e6f671f6ace529ca"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:a9d019fa4d8d8b9b4d14c9faff2459f4a1b450ae6bdc9193c53106544cb8c92b"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:5ef5489a39850ac3f0a960edcf76587e877fbb66aaf62a41e9fa267fbc39bf5e"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:055e44b348868a8c125af0eda01813aedaf7da4e37e1eab09fa869d353b2da7a"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:9d10186aa74cdb50e499b69a6a78e0a0b0398615fb1f0a4769b909539bf4fab4"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:41781308ce8cee4cd05a4ed8958761fe48dc2c5159bd114c942b953bc91f2c1d"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:d58c61f02c2c477fd8d423259f6c51f65ed8c57c6aa2df3dd98272d47974a38c"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:138701f32f1f570f46f50b6779d35d0b52175ee7eba37e6f26918321daa65d22"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:e94b61c2ebbaab58db6b525b79cdc78072723ea9bd8f838cd79ad850f25cc275"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:c0f3a53dc57682b157ad50e8c2671191c629d715871afd9b5c017a4be1f4e247"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:32e8d47268d19e09a1c2728b7d9bfb998bd6b30f4dfaf5d48c3e0b13f5263256"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:a9f940f04e2511ec6c25e083635ca7e0c88518b33745ac84beb611c0feb8d497"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:6d9efd050375c82cec1eaae20894a56fb2191f22d41758ce920b06e0a5a7c736"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:ddadba1f19ca590b3a2c1677da2fadcbb2115fb7c32aeab0d5fa049633995e69"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:036ee98fb6b07b8c84bd23daf431c1b1dadaed1ba6ea71fa76d8e1afefad3da9"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:11f9052ad1682458731cb2793f043a094ca917f89f0448f99a41c21b4c22faea"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d"},{"edge_kind":"extracted","from_key":"File:3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","to_key":"File:1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":28,"files_written_count":189,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6add2a7cb6bcf8b3a40ece9b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"malware_family":"Trojan.Agent","submit_name":"Instaloader-GUI-Wrapper_v.1.4.exe","analysis_start_time":"2026-10-24T22:00:37+00:00","indicators_count":{"informative":187,"suspicious":38,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}],"processes":[{"pid":4376,"ppid":0,"name":"Instaloader-GUI-Wrapper_v.1.4.exe","command_line":"","sha256":"3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","normalized_path":"C:\\Instaloader-GUI-Wrapper_v.1.4.exe","uid":"00000000-00004376","icon":"$54"},{"pid":1580,"ppid":4376,"name":"Instaloader-GUI-Wrapper_v.1.4.exe","command_line":"","sha256":"3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d","normalized_path":"C:\\Instaloader-GUI-Wrapper_v.1.4.exe","parent_uid":"00000000-00004376","uid":"00000000-00001580"},{"pid":8280,"ppid":1580,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001580","uid":"00000000-00008280"}],"all_imported_dlls":["umpdc.dll","Windows.UI.dll","WindowManagementAPI.dll","imm32.dll","cryptsp.dll","shlwapi.dll","VCRUNTIME140_1.dll","mpr.dll","MSVCP140_1.dll","MSVCP140_2.dll","d3d9.dll","win32u.dll","profapi.dll","SHCore.dll","ntmarta.dll","advapi32.dll","VxSSL64.dll","msvcp140.dll","version.dll","UIAutomationCore.dll","devobj.dll","qmodernwindowsstyle.dll","qico.dll","ntdll.dll","rpcrt4.dll","ole32.dll","srvcli.dll","libssl-3-x64.dll","msvcrt.dll","python313.dll","icuuc.dll","libcrypto-3-x64.dll","dxgi.dll","fastprox.dll","dcomp.dll","kernel32.dll","comctl32.dll","Qt6Core.dll","authz.dll","Qt6Widgets.dll","windows.storage.dll","powrprof.dll","libffi-8.dll","DWrite.dll","Qt6Svg.dll","mswsock.dll","cfgmgr32.dll","wtsapi32.dll","CoreUIComponents.dll","WinTypes.dll","sechost.dll","vcruntime140_1.dll","netapi32.dll","propsys.dll","IPHLPAPI.DLL","comdlg32.dll","twinapi.appcore.dll","gdi32full.dll","bcrypt.dll","winmm.dll","icu.dll","wbemsvc.dll","wldp.dll","InputHost.dll","DataExchange.dll","fltLib.dll","vcruntime140.dll","msctf.dll","samcli.dll","Qt6Gui.dll","wintrust.dll","msasn1.dll","uxtheme.dll","user32.dll","combase.dll","D3D12.dll","setupapi.dll","CoreMessaging.dll","ws2_32.dll","userenv.dll","cryptbase.dll","clbcatq.dll","wbemprox.dll","amsi.dll","d3d10warp.dll","bcryptprimitives.dll","netutils.dll","crypt32.dll","dwmapi.dll","Windows.UI.Immersive.dll","qsvgicon.dll","python3.dll","qsvg.dll","KernelBase.dll","gdi32.dll","msvcp_win.dll","ucrtbase.dll","VCRUNTIME140.dll","627ES8T4.dll","qwindows.dll","TextInputFramework.dll","oleaut32.dll","shell32.dll","d3d11.dll","kernel.appcore.dll","wbemcomn.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"MSVCP140.dll","sha256":"0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"MSVCP140_2.dll","sha256":"3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Qt6Core.dll","sha256":"0fe05230bb3421a1ffcd91866016431f0633fc4d84aeb7ff75f6b14232b0c858","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Qt6Gui.dll","sha256":"1beb8c0e41dfd83b64c189d8c13dce15affdca3ba4368196bbce8c2c4a1fcf69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Qt6Pdf.dll","sha256":"8b068e0a7d1d99a5d18c8cf131fd1ee12bd94fcbb4f8a0ddd8911c9bd7135c24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Qt6Svg.dll","sha256":"b472d01159a858c5b9dfe8032b9994201ecc9ab967b4173379f0b05554766196","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Qt6Widgets.dll","sha256":"c9a88f29e2022697148baa49f85b1e8f919ce704c284af52e275103dea99c4af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"VCRUNTIME140.dll","sha256":"d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"opengl32sw.dll","sha256":"d625ca7e908aabafe5e0048074ea8b2c6d12f8be26e2a4889e9fd303bbb60502","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qtuiotouchplugin.dll","sha256":"c06dccfd97576b6255b56df43b03b1eabee8c01f75b6bf6ad550057771ab7cf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qsvgicon.dll","sha256":"84f7391fb8cd5a9228d3d38ebcbf957e6c7cdc789981e7a4e6f671f6ace529ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qjpeg.dll","sha256":"a9d019fa4d8d8b9b4d14c9faff2459f4a1b450ae6bdc9193c53106544cb8c92b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qtiff.dll","sha256":"5ef5489a39850ac3f0a960edcf76587e877fbb66aaf62a41e9fa267fbc39bf5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qwebp.dll","sha256":"055e44b348868a8c125af0eda01813aedaf7da4e37e1eab09fa869d353b2da7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qminimal.dll","sha256":"9d10186aa74cdb50e499b69a6a78e0a0b0398615fb1f0a4769b909539bf4fab4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qoffscreen.dll","sha256":"41781308ce8cee4cd05a4ed8958761fe48dc2c5159bd114c942b953bc91f2c1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qwindows.dll","sha256":"d58c61f02c2c477fd8d423259f6c51f65ed8c57c6aa2df3dd98272d47974a38c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qmodernwindowsstyle.dll","sha256":"138701f32f1f570f46f50b6779d35d0b52175ee7eba37e6f26918321daa65d22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Qt6Network.dll","sha256":"e94b61c2ebbaab58db6b525b79cdc78072723ea9bd8f838cd79ad850f25cc275","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qgif.dll","sha256":"c0f3a53dc57682b157ad50e8c2671191c629d715871afd9b5c017a4be1f4e247","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qicns.dll","sha256":"32e8d47268d19e09a1c2728b7d9bfb998bd6b30f4dfaf5d48c3e0b13f5263256","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qico.dll","sha256":"a9f940f04e2511ec6c25e083635ca7e0c88518b33745ac84beb611c0feb8d497","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qpdf.dll","sha256":"6d9efd050375c82cec1eaae20894a56fb2191f22d41758ce920b06e0a5a7c736","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qsvg.dll","sha256":"ddadba1f19ca590b3a2c1677da2fadcbb2115fb7c32aeab0d5fa049633995e69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qtga.dll","sha256":"036ee98fb6b07b8c84bd23daf431c1b1dadaed1ba6ea71fa76d8e1afefad3da9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"qwbmp.dll","sha256":"11f9052ad1682458731cb2793f043a094ca917f89f0448f99a41c21b4c22faea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"MSVCP140_1.dll","sha256":"bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"VCRUNTIME140_1.dll","sha256":"1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\MSVCP140.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\MSVCP140_1.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\MSVCP140_2.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\Qt6Core.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\Qt6Gui.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\Qt6Network.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\Qt6Pdf.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\Qt6Svg.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\Qt6Widgets.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\bin\\opengl32sw.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\generic\\qtuiotouchplugin.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\iconengines\\qsvgicon.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qgif.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qicns.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qico.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qjpeg.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qpdf.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qsvg.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qtga.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qtiff.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qwbmp.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\imageformats\\qwebp.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\platforms\\qminimal.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\platforms\\qoffscreen.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\platforms\\qwindows.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\plugins\\styles\\qmodernwindowsstyle.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_ar.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_bg.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_ca.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_cs.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_da.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_de.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_en.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_es.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_fa.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_fi.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_fr.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_gd.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_gl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_he.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_ar.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_bg.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_ca.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_cs.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_da.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_de.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_en.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_es.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_fr.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_gl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_hr.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_hu.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_it.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_ja.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_ka.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_ko.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_nl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_nn.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_pl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_pt_BR.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_ru.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_sk.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_sl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_sv.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_tr.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_uk.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_zh_CN.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_help_zh_TW.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_hr.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_hu.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_it.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_ja.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_ka.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_ko.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_lg.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_lt.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_lv.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_nl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_nn.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_pl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_pt_BR.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_pt_PT.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_ru.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_sk.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_sl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_sv.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_tr.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_uk.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_zh_CN.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qt_zh_TW.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_ar.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_bg.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_ca.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_cs.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_da.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_de.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_en.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_es.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_fa.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_fi.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_fr.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_gd.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_he.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_hr.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_hu.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_it.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_ja.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_ka.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_ko.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_lg.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_lv.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_nl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_nn.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_pl.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_pt_BR.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_ru.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_sk.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_sv.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_tr.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_uk.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_zh_CN.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\Qt6\\translations\\qtbase_zh_TW.qm","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\QtCore.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\QtGui.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\QtSvg.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\QtWidgets.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\PyQt6\\sip.cp313-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\certifi\\py.typed","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\charset_normalizer\\md.cp313-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\charset_normalizer\\md__mypyc.cp313-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\icon.ico","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\libcrypto-3-x64.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\libssl-3-x64.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\python313.dll","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\setuptools\\_vendor\\importlib_metadata-8.0.0.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\setuptools\\_vendor\\jaraco\\text\\Lorem ipsum.txt","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%TEMP%\\_MEI43762\\instagram_downloader.log","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\drag_handle_e1e5e9_90.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\arrow_drop_up_ffffff2f_270.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\arrow_drop_up_e1e5e9_180.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\arrow_drop_up_ffffff5f_90.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\check_box_e4e7eb66_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\arrow_drop_up_ffffff2f_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\arrow_drop_up_ffffff2f_90.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\vertical_line_ffffff35_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\drag_indicator_e4e7eb66_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\expand_less_e4e7eb66_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\indeterminate_check_box_e4e7eb66_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\drag_indicator_e1e5e9_90.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\check_e1e5e9_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\indeterminate_check_box_8ab4f7_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\expand_less_e4e7eb66_180.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\chevron_right_e4e7eb66_180.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\expand_less_e1e5e9_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\radio_button_unchecked_e4e7eb66_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"path":"%USERPROFILE%\\.cache\\qdarktheme\\v2.1.0\\drag_indicator_e1e5e9_0.svg","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Local\\SM0:4376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"SM0:4376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"SM0:1580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Local\\SM0:1580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"SM0:1580:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1580:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]},{"name":"SM0:8280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add2a7cb6bcf8b3a40ece9b"}]}]}},"report_ids":{"sandbox_job_ids":["6add2a7cb6bcf8b3a40ece9b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware_60.0 Sample 3d307fa80e30… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3d307fa80e30…. Malware family: Malware_60.0. Threat score 100/100. 2/25 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware_60.0 Sample 3d307fa80e30… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3d307fa80e30…. Malware family: Malware_60.0. Threat score 100/100. 2/25 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3d307fa80e302464d98dd80fd0762402403d52784f402a9588f541e47c3b317d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware_60.0 Sample 3d307fa80e30… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3d307fa80e30…. Malware family: Malware_60.0. Threat score 100/100. 2/25 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L55","11",{}]]